.NET : How to set user information in an EventLog Entry?

Question

The System.Diagnostics.EventLog class provides a way to interact with a windows event log. I use it all the time for simple logging...

System.Diagnostics.Ev         


        

Answer 1

Toughie ...

I looked for a way to fill the user field with a .NET method. Unfortunately there is none, and you must import the plain old Win32 API [ReportEvent function](http://msdn.microsoft.com/en-us/library/aa363679(VS.85).aspx) with a DLLImportAttribute

You must also redeclare the function with the right types, as Platform Invoke Data Types says

So

BOOL ReportEvent(
__in  HANDLE hEventLog,
__in  WORD wType,
__in  WORD wCategory,
__in  DWORD dwEventID,
__in  PSID lpUserSid,
__in  WORD wNumStrings,
__in  DWORD dwDataSize,
__in  LPCTSTR *lpStrings,
__in  LPVOID lpRawData
);

becomes

[DllImport("Advapi32.dll", EntryPoint="ReportEventW",  SetLastError=true,
CharSet=CharSet.Unicode)]
bool WriteEvent(
  IntPtr hEventLog, //Where to find it ?
  ushort  wType,
  ushort  wCategory,
  ulong dwEventID,
  IntPtr lpUserSid, // We'll leave this struct alone, so just feed it a pointer
  ushort wNumStrings,
  ushort dwDataSize,
  string[] lpStrings,
  IntPtr lpRawData
);

You also want to look at [OpenEventLog](http://msdn.microsoft.com/en-us/library/aa363672(VS.85).aspx) and [ConvertStringSidToSid](http://msdn.microsoft.com/en-us/library/aa376402(VS.85).aspx)

Oh, and you're writing unmanaged code now... Watch out for memory leaks.Good luck :p