Alex Rivera | Logout

Receiving "...has already been registered..." from EventLog.CreateEventSource even though I'm checking !EventLog.SourceExists

Asked 2010-07-22T08:47:37.037
11

My following code fails with "...has already been registered as a source on the local computer" even though I'm doing checks first:

lock ( eventLock )
{
    string eventLog = Constants.EventLogPL;
    string eventSrc = Constants.EventSrcPL;

    if (!EventLog.Exists(eventLog))
    {
        if (!EventLog.SourceExists(eventSrc))
        {
            try
            {
                EventLog.CreateEventSource(eventSrc, eventLog);
            }
            catch (Exception e)
            {
                System.Diagnostics.Debug.WriteLine(e.Message);
            }
        }
    }
}

I'd have thought my call to !EventLog.SourceExists would have been enough to prevent my error! I'm on 2010 .NET 4 and Windows 7 64 compiling to any CPU.

Edit: Updated code to get Constant's to locals to check they don't change, and use locking to make sure only one thread can test and create. Code still fails with the same error.

Edit
Report

1 Answer

24

Found the problem after digging in to Sysinternals' Process Monitor a little more:

Calling EventLog.Exists("MyLog");

Logs Name not found, as expected in:

KLM\System\CurrentControlSet\services\eventlog\MyLog

Calling EventLog.SourceExists("MySource");

Checks several places, name not found in as expected:

HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
HKLM\System\CurrentControlSet\services\eventlog\Security\MySource
HKLM\System\CurrentControlSet\services\eventlog\System\MySource
HKLM\System\CurrentControlSet\services\eventlog\VisualSVNServer\MySource
HKLM\System\CurrentControlSet\services\eventlog\Windows PowerShell\MySource
HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
HKLM\Syste

answered 2010-07-22T10:06:34.773

Your Answer