August 19th, 2009, 04:39 AM
Many event sources fire events in my custom event log
I have created a custom log named MYLOG and my application (MYAPP) fires events in it.
The sources file contains "MYLOG,MYAPP" but I could see that more event sources fire events
in MYLOG. Some of these are: MSSQL$SQLEXPRESS, SecurityCenter, SceCli, LoadPerf.
I would like only MYAPP to be able to fire events in MYLOG and not other apps. How can I do this?
(I do not use .NET)
Thank you in advance!
January 20th, 2010, 06:45 AM
Re: Many event sources fire events in my custom event log
For everyone who might be interested, I found the solution.
In the registry key of your custom event log (HKLM\System\CurrentControlSet\Services\EventLog\YourCustomEventLog), there is a File key.
The File key contains the path to the event file.
At my case, this used to be something like "%SystemRoot%\\system32\\config\\YourCusto.evt"
Instead of "%SystemRoot%", I used the GetSystemDirectory function in order get the system's directory. So, the path changed to "C:\WINDOWS\system32\config\YourCusto.evt". Using the latest path for the File key, it works!
Tags for this Thread
Click Here to Expand Forum to Full Width