How to create Event Source using PowerShell Command in Microsoft Windows 2008 R2

In my previous Blog “Writing Event Logs for SharePoint 2010 Projectsin C#”, we looked at creating Event Logs using C# for SharePoint 2010. In order to use the event logs in specific “Source” first we need to create a source. It could be done using the code but I think it would be an added overhead to check for the source every time a log is written. Moreover, it would turn out to be a nightmare if you end up having security exceptions while creating the event source through the code :S You can easily create a source using the PowerShell Command as given below:

[System.Diagnostics.EventLog]::CreateEventSource(“MySource”, "Application")

Here you go, it is that simple …. This simple creates an event source with the name “MySource” under “Application” Log. Or you could also end up adding a new custom log by having “MyProject” instead of “Application” in the method above.

And of course don’t forget to run the power shell as Administrator ;)

Writing Event Logs for SharePoint 2010 Projects in C#

The Background


There are times when you track issues which may occur in the web parts you developed. You can use the Event logs for this purpose using C#.NET. You can write to SharePoint ULS which is also an ideal place to write logs but we will concentrate on Event Logs for now. I will write the post that will deal with the SharePoint ULS soon.


The Solution

Writing event logs in SharePoint 2010 projects are the same as you would typically do on a Classic ASP.NET Application, the only difference would be that you will need to run the CODE under Elevated Privileges. Let’s see it in the code now, shall we? Get ready it is HUGE!! ;)
 

SPSecurity.RunWithElevatedPrivileges(delegate()

            {             
                System.Diagnostics.EventLog.WriteEntry("MyWebparts", message, System.Diagnostics.EventLogEntryType.Error);
            });
 

Well, that is it! One thing that you may be thinking is I did not check for the “MyWebparts” Event Source, if its created or not. I purposely did not write it and here’s the code for it.
 

if (!EventLog.SourceExists(“MyWebparts”))

         EventLog.CreateEventSource(“MyWebparts”,”Application”);


Now the reason why I did not use this is because sometimes you don’t have the required permissions to create an Even Source on the Server in the context on which this code is running. For this purpose, I just create the Event Source on the Web Front End Servers by using PowerShell command. You can find the post under “How to create Event Source using PowerShell Command in Microsoft Windows 2008 R2”. Once the Event Source is set up, the above code will run without any glitches.

NOTE: It is important that you create Event Source on ALL the WEB FRONT END SERVERS in order to avoid any issues relating to writing Event Logs on SharePoint 2010 Multi Farm environments.

Also another fun part that I would like to share is that we can then create Custom Views in the Event Viewer so that You can see exactly what you would be looking for like for instance in this case it would be something like this…
All I did was created a custom view and queried against the Event Source which here is “.NET RunTime” or “MyWebparts” in our case. Hope you find this article useful. Thanks!!!
Some useful links related to Events log:

http://support.microsoft.com/kb/307024
 
http://www.codeproject.com/KB/trace/writing_to_system_event.aspx