This documentation is archived and is not being maintained.

EventLogInstaller Class

Allows you to install and configure an event log that your application reads from or writes to when running.

Namespace:  System.Diagnostics
Assembly:  System.Configuration.Install (in System.Configuration.Install.dll)

public class EventLogInstaller : ComponentInstaller

The EventLogInstaller is used by the Installer Tool (Installutil.exe) when installing an event log. The EventLogInstaller class can install event logs only on the local computer.

Use the EventLogInstaller class when your application writes to an event log; it is not necessary to use an event log installer for your application to read from an event log. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.


The Security log is read-only.

The installer creates the event source that you specify in the Source property and registers it for the event log specified in Log property. This behavior is similar to calling CreateEventSource on the EventLog component.

Use the WriteEvent and WriteEntry methods to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configurations. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an EventLogInstaller, or using the CreateEventSource method. You must have administrative rights on the computer to create a new event source.

You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

To install an event log, create a project installer class that inherits from Installer, and set the RunInstallerAttribute for the class to true. Within your project, create an EventLogInstaller for each event log that your application will write to and add the instance to your project installer class.

When the Installer Tool (Installutil.exe) is called, it looks at the RunInstallerAttribute. If it is true, the tool installs all the items in the Installers collection that are associated with your project installer. If RunInstallerAttribute is false, the tool ignores the project installer.

You modify other properties of an EventLogInstaller either before or after adding the instance to the Installers collection of your project installer, but before the installer tool runs. You must set the Source property if your application will be writing to the event log.

Use EventLogInstaller to register a new source for a new or existing event log; do not use EventLogInstaller to change an existing source. The EventLogInstaller class does not modify the configuration properties of an existing source to match the specified installation properties. The Install method throws an exception if the Source property matches a source name that is registered for a different event log on the computer. The Install method does not register the source if the Source property matches a source name that is already registered for the same event log specified in the Log property.

You can register the event source with localized resource files for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string. The Event Viewer uses the resource identifier to find and display the corresponding string from the localized resource file based on current language settings. You can register a separate file for event categories, messages, and parameter insertion strings, or you can register the same resource file for all three types of strings. Use the CategoryCount, CategoryResourceFile, MessageResourceFile, and ParameterResourceFile properties to configure the source to write localized entries to the event log. If your application writes strings values directly to the event log, you do not need to set these properties.

The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the WriteEvent method to write entries using resource identifiers to the event log. Create a different source without resource files and then use that source in the WriteEntry method to write strings directly to the event log using that source.

Typically, you do not call the methods of the EventLogInstaller class from within your code; they are generally called only by Installutil.exe. The tool automatically calls the Install method during the installation process. It backs out failures, if necessary, by calling the Rollback method for the object that generated the exception.

Windows 98, Windows Millennium Edition Platform Note: Event logs are not supported on Windows 98/Windows Millennium Edition (Me).

The following code example sets the installation properties for a new event source. The code example sets the source name and the event log name, and adds the EventLogInstaller to the Installers collection.

using System;
using System.Configuration.Install;
using System.Diagnostics;
using System.ComponentModel;

public class MyEventLogInstaller: Installer
    private EventLogInstaller myEventLogInstaller;

    public MyEventLogInstaller() 
        // Create an instance of an EventLogInstaller.
        myEventLogInstaller = new EventLogInstaller();

        // Set the source name of the event log.
        myEventLogInstaller.Source = "NewLogSource";

        // Set the event log that the source writes entries to.
        myEventLogInstaller.Log = "MyNewLog";

        // Add myEventLogInstaller to the Installer collection.

    public static void Main()
        MyEventLogInstaller myInstaller = new MyEventLogInstaller();

Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

.NET Framework

Supported in: 3.5, 3.0, 2.0, 1.1, 1.0