EventLogger ignores provided EventLogSettings.SourceName

[GenetecMan]

Description

The Microsoft.Extensions.Logging.AddEventLog(this ILoggingBuilder builder, EventLogSettings settings) extension method allows one to redefine various pamaterers, such as SourceName. However, redefining this does nothing except stop the proper logging of information into the Windows Event Viewer.

Reproduction Steps

There is an example in this repository.

Using the default Worker Service C# template:
In appsettings.json:

{
  "Logging": {
    "LogLevel": {
      "Default": "Debug",
      "Microsoft.Hosting.Lifetime": "Debug"
    }
  }
}

In Program.cs

            .ConfigureLogging(logging =>
            {
                if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
                {
                    logging.AddEventLog(new Microsoft.Extensions.Logging.EventLog.EventLogSettings()
                    {
                        LogName = "Application",
                        SourceName = "Monitor"
                    });
                }
            })

In Worker.cs

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            // This logs correctly.
            if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
            {
                var log = new EventLog("Application")
                {
                    Source = "Test123"
                };

                log.WriteEntry("Error 123");
            }

            // This line simply does not show up!
            _logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);

            // This line shows up in the event log under SourceName ".NET Runtime".
            // The same happens for LogError.
            _logger.LogWarning("Worker running at: {time}", DateTimeOffset.Now);

            await Task.Delay(1000, stoppingToken);
        }
    }

Check in event viewer, you should have something like this:

Expected behavior

1. The LogInformation line should be displayed.
2. The LogWarning/LogError lines should have the correct Source Name.

Actual behavior

1. The LogInformation line is not displayed (so most likely not logged).
2. The LogWarning/LogError lines do not have the correct Source Name.

Regression?

No response

Known Workarounds

No response

Configuration

• .NET 7
• Microsoft.Extensions.Logging
• Windows 10 Entreprise, x64
• Most likely not specific to this configuration

Other information

No response

Tagging subscribers to this area: @dotnet/area-extensions-logging
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

The Microsoft.Extensions.Logging.AddEventLog(this ILoggingBuilder builder, EventLogSettings settings) extension method allows one to redefine various pamaterers, such as SourceName. However, redefining this does nothing except stop the proper logging of information into the Windows Event Viewer.

Reproduction Steps

There is an example in this repository.

Using the default Worker Service C# template:
In appsettings.json:

{
  "Logging": {
    "LogLevel": {
      "Default": "Debug",
      "Microsoft.Hosting.Lifetime": "Debug"
    }
  }
}

In Program.cs

            .ConfigureLogging(logging =>
            {
                if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
                {
                    logging.AddEventLog(new Microsoft.Extensions.Logging.EventLog.EventLogSettings()
                    {
                        LogName = "Application",
                        SourceName = "Monitor"
                    });
                }
            })

In Worker.cs

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            // This logs correctly.
            if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
            {
                var log = new EventLog("Application")
                {
                    Source = "Test123"
                };

                log.WriteEntry("Error 123");
            }

            // This line simply does not show up!
            _logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);

            // This line shows up in the event log under SourceName ".NET Runtime".
            // The same happens for LogError.
            _logger.LogWarning("Worker running at: {time}", DateTimeOffset.Now);

            await Task.Delay(1000, stoppingToken);
        }
    }

Check in event viewer, you should have something like this:

Expected behavior

1. The LogInformation line should be displayed.
2. The LogWarning/LogError lines should have the correct Source Name.

Actual behavior

1. The LogInformation line is not displayed (so most likely not logged).
2. The LogWarning/LogError lines do not have the correct Source Name.

Regression?

No response

Known Workarounds

No response

Configuration

• .NET 7
• Microsoft.Extensions.Logging
• Windows 10 Entreprise, x64
• Most likely not specific to this configuration

Other information

No response

Author:	GenetecMan
Assignees:	-
Labels:	untriaged, area-Extensions-Logging
Milestone:	-

[tarekgh]

@GenetecMan

• For the entries that are not get logged, this is because the default logging level for EventLogLogger is Warning and you were trying to log Information. Please have a look at the doc https://learn.microsoft.com/en-us/dotnet/core/extensions/logging-providers#windows-eventlog which specifies what you need to add to the configuration to enable Information logging.

To log events lower than [LogLevel.Warning](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.loglevel#microsoft-extensions-logging-loglevel-warning), explicitly set the log level. The following example sets the Event Log default log level to [LogLevel.Information](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.loglevel#microsoft-extensions-logging-loglevel-information):

"Logging": {
  "EventLog": {
    "LogLevel": {
      "Default": "Information"
    }
  }
}

• For the entries that are logged under .NET Runtime instead of Monitor. In your environment, is the Source Monitor created and accessible? I mean what you get if you execute the following code from inside your app:

    var log = new EventLog("Application")
    {
        Source = "Monitor"
    };

    log.WriteEntry("Error 0123456789");

This issue has been marked needs-author-action and may be missing some important information.

[GenetecMan]

@tarekgh

• For the entries that are logged under .NET Runtime instead of Monitor. In your environment, is the Source Monitor created and accessible? I mean what you get if you execute the following code from inside your app:

    var log = new EventLog("Application")
    {
        Source = "Monitor"
    };

    log.WriteEntry("Error 0123456789");

Every time I run the application not as administrator, it throws this:

System.Security.SecurityException : 'The source was not found, but some or all event logs could not be searched. To create the source, you need permission to read all event logs to make sure that the new source name is unique. Inaccessible logs: Security, State.'

Once I run it as administrator, I can run it "normally" and it won't throw.

For the entries that are not get logged, this is because the default logging level for EventLogLogger is Warning and you were trying to log Information. Please have a look at the doc https://learn.microsoft.com/en-us/dotnet/core/extensions/logging-providers#windows-eventlog which specifies what you need to add to the configuration to enable Information logging.

Adding the provided section to the appsettings.json does result in the EventLog with a level of Information to be logged. It doesn't fix the underlying problem of the SourceName being ignored.

[tarekgh]

It doesn't fix the underlying problem of the SourceName being ignored.

Were you running your app as administrator in this case?