This documentation is archived and is not being maintained.

EventLogTraceListener Class

Updated: August 2008

Provides a simple listener that directs tracing or debugging output to an EventLog.

Namespace:  System.Diagnostics
Assembly:  System (in System.dll)

[HostProtectionAttribute(SecurityAction.LinkDemand, Synchronization = true)]
public sealed class EventLogTraceListener : TraceListener


The HostProtectionAttribute attribute applied to this type or member has the following Resources property value: Synchronization. The HostProtectionAttribute does not affect desktop applications (which are typically started by double-clicking an icon, typing a command, or entering a URL in a browser). For more information, see the HostProtectionAttribute class or SQL Server Programming and Host Protection Attributes.

An instance of this EventLogTraceListener can be added to the Debug.Listeners, Trace.Listeners, or TraceSource.Listeners collections to send output from tracing or debugging to an EventLog. You can add the instance in your code or specify it in the application configuration file. To add an EventLogTraceListener using an application configuration file, edit the file that corresponds to the name of your application or the app.config file in a Visual Studio 2005 project. In this file, insert an element for a System.Diagnostics.EventLogTraceListener type.

The following example adds a EventLogTraceListener object named myListener to the Trace.Listeners collection. The initializeData parameter specifies the name of the event log source that is to be passed to the EventLogTraceListener(String) constructor.

    <trace autoflush="false" indentsize="4">
        <add name="myListener"
          initializeData="TraceListenerLog" />

For more information about how to add trace listeners in the application configuration file, see <listeners> element or <listeners> element for <source>.


If the Source for the event log that is associated with the EventLogTraceListener instance does not exist, a new event source is created. To create an event source in Windows Vista, Windows XP Professional, or Windows Server 2003, you must have administrative privileges.

The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. In Windows Vista, users do not have permission to access the security log; therefore, a SecurityException is thrown.

In Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

The class provides the EventLog property to get or set the event log that receives the tracing or debugging output, and the Name property to hold the name of the EventLogTraceListener.

The Close method closes the event log so it no longer receives tracing or debugging output. The Write and WriteLine methods write a message to the event log.


To avoid the possibility of writing large amounts of data to the event log, the EventLogTraceListener does not output the optional trace data specified by the TraceOutputOptions property.

The following example creates a trace listener that sends output to an event log. First, the code creates a new EventLogTraceListener that uses the source myEventLogSource. Next, myTraceListener is added to the Trace.Listeners collection. Finally, the example sends a line of output to the Listeners object.

public static void Main(string[] args) {

    // Create a trace listener for the event log.
    EventLogTraceListener myTraceListener = new EventLogTraceListener("myEventLogSource");

    // Add the event log trace listener to the collection.

    // Write output to the event log.
    Trace.WriteLine("Test output");


This type is thread safe.

Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

.NET Framework

Supported in: 3.5, 3.0, 2.0, 1.1, 1.0




August 2008

Added configuration file example and note about creating event sources in Windows Vista.

Customer feedback.