System Security SecurityException when writing to Event Log

Question

I   m working on trying to port an ASP NET app from Server 2003  and IIS6  to Server 2008  IIS7     When I try and visit the page on the browser I get this      Server Error in         Application       Security Exception      Description  The application attempted to perform an operation not allowed by the security policy  To grant this application the required permission please contact your system administrator or change the application   s trust level in the configuration file       Exception Details  System Security SecurityException  The source was not found  but some or all event logs could not be searched  Inaccessible logs  Security      Source Error       An unhandled exception was generated during the execution of the current web request  Information regarding the origin and the location of the exception can be identified using the exception stack trace below       Stack Trace        SecurityException  The source was not found  but some or all event logs could not be searched  Inaccessible logs  Security        System Diagnostics EventLog FindSourceRegistration String source  String machineName  Boolean readOnly   562   System Diagnostics EventLog SourceExists String source  String machineName   251       snip    These are the things I   ve done to try and solve it    Give    Everyone    full access permission to the key HKEY LOCAL MACHINE SYSTEM CurrentControlSet Services EventLog Security  This worked  But naturally I can   t do this in production  So I deleted the    Everyone    permission after running the app for a few minutes and the error re-appeared  I created the source in the Application log and the Security log  and I verified it exists via regedit  during installation with elevated permissions but the error remained  I gave the app a full trust level in the web config file  and using appcmd exe  but to no avail    Does anyone have an insight as to what could be done here   PS  This is a follow up to this question  I followed the given answers but to no avail  see  2 above

User · Answer

Rebuilding the solution worked for me

User · Answer

I m not working on IIS  but I do have an application that throws the same error on a 2K8 box  It works just fine on a 2K3 box  go figure   My resolution was to  Run as administrator  to give the application elevated rights and everything works happily  I hope this helps lead you in the right direction   Windows 2008 is rights permissions elevation is really different from Windows 2003  gar

User · Answer

For me ony granting  Read  permissions for  NetworkService  to the whole  EventLog  branch worked

User · Answer

A new key with source name used need to be created under HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog Application in the regEdit when you use System Diagnostics EventLog WriteEntry  SourceName    ErrorMessage   EventLogEntryType Error     So basically your user does not have permission to create the key  The can do the following depending of the user that you are using from the Identity value in the Application Pool Advanced settings     Run RegEdit and go to HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog Right click in EventLog key and the select Permissions    option 3 Add your user with full Control access    -If you are using  NetworkService  add NETWORK SERVICE user  -If you are usinf  ApplicationPoolIdentity  add IIS APPPOL name of your app pool   use local machine location when search the user    -If you are using  LocalSystem  make sure that the user has Administrator permissions  It is not recommend for vulnerabilities   Repeat the steps from 1 to 3 for HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog Security   For debugging with Visual Studio I use  NetworkService   it is ASP NET user  and when the site is published I used  AppicationPoolIdentity

User · Answer

try below in web config    lt system web gt    lt trust level  Full   gt    lt  system web gt

User · Answer

My app gets installed on client web servers  Rather than fiddling with Network Service permissions and the registry  I opted to check SourceExists and run CreateEventSource in my installer     I also added a try catch around log source    xx  in the app to set it to a known source if my event source wasn t created  This would only come up if I hot swapped a  dll instead of re-installing

User · Answer

I try almost everything in here to solve this problem    I share here the answer that help me   Another way to resolve the issue    in IIS console  go to application pool managing your site  and note the identity running it  usually Network Service  make sure this identity can read KEY LOCAL MACHINE SYSTEM CurrentControlSet Services Eventlog  rigth-click  authorisations  now change the identity of this application pool to Local System  apply  and switch back to Network Service  Credentials will be reloaded and EventLog reacheable  in http   geekswithblogs net timh archive 2005 10 05 56029 aspx   thanks Michael Freidgeim

User · Answer

Had a similar issue with all of our 2008 servers   The security log stopped working altogether because of a GPO that took the group Authenticated Users and read permission away from the key HKLM System CurrentControlSet Services EventLog security  Putting this back per Microsoft s recommendation corrected the issue   I suspect giving all authenticated users read at a higher level will also correct your problem

User · Answer

To give Network Service read permission on the EventLog Security key  as suggested by Firenzi and royrules22  follow instructions from http   geekswithblogs net timh archive 2005 10 05 56029 aspx   Open the Registry Editor    Select Start then Run Enter regedt32 or regedit  Navigate expand to the following key   HKEY LOCAL MACHINE SYSTEM CurrentControlSet Services Eventlog Security Right click on this entry and select Permissions Add the Network Service user Give it Read permission   UPDATE  The steps above are ok on developer  machines  where you do not use deployment process to install application  However if you deploy your application to other machine s   consider to register event log sources during installation as suggested in SailAvid s and Nicole Calinoiu s answers   I am using PowerShell function  calling in Octopus Deploy ps1   function Create-EventSources          eventSources      MySource1   MySource2        foreach   source in  eventSources                if   System Diagnostics EventLog   SourceExists  source  -eq  false                     System Diagnostics EventLog   CreateEventSource  source   Application

User · Answer

I ran into the same issue  but I had to go up one level and give full access to everyone to the HKEY LOCAL MACHINE SYSTEM CurrentControlSet Services EventLog  key  instead of going down to security  that cleared up the issue for me

User · Answer

This exception was occurring for me from a  NET console app running as a scheduled task  and I was trying to do basically the same thing - create a new Event Source and write to the event log   In the end  setting full permissions for the user under which the task was running on the following keys did the trick for me   HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog Application HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog Security HKEY LOCAL MACHINE SYSTEM CurrentControlSet services eventlog

User · Answer

I had a console application where I also had done a  quot Publish quot  to create an Install disk  I was getting the same error at the OP    The solution was right click setup exe and click Run as Administrator  This enabled the install process the necessary privilege s

User · Answer

I had a very similar problem with a console program I develop under VS2010  upgraded from VS2008 under XP  My prog uses EnLib to do some logging  The error was fired because EntLib had not the permission to register a new event source   So I started once my compiled prog as an Administrator   it registered the event source  Then I went back developping and debugging from inside VS without problem    you may also refer to http   www blackwasp co uk EventLog 3 aspx  it helped me

User · Answer

I hit similar issue - in my case Source contained  lt    gt  characters  64 bit machines are using new even log - xml base I would say and these characters  set from string  create invalid xml which causes exception  Arguably this should be consider Microsoft issue - not handling the Source  name string  correctly

User · Answer

I had this issue when running an app within VS  All I had to do was run the program as Administrator once  then I could run from within VS   To run as Administrator  just navigate to your debug folder in windows explorer  Right-click on the program and choose Run as administrator

User · Answer

Hi I ran into the same problem when I was developing an application and wanted to install it on a remote PC  I fixed it by doing the following   1  Goto your registry  locate  HKLM System CurrentControlSet Services EventLog Application    YOUR SERVICE OR APP NAME      Note that      YOUR SERVICE OR APP NAME      is your application service name as you defined it when you created your  NET deployment  for example  if you named your new application  My new App  then the key would be  HKLM System CurrentControlSet Services EventLog Application My New app  Note2  Depending on which eventLog you are writing into  you may find on your DEV box   Application   as noted above   or also   System  or   Security  depending on what event your application is writing into  mostly    Application  should be fine all the times   2  Being on the key above  From the menu  Select  FILE  -   Export   and then save the file   Note  This would create your necessary registry settings when the application would need to access this key to write into the Event Viewer   the new file will be a  REG file  for the argument sake  call it  My New App REG   3  When deploying on PRODuction  consult the Server s System s administrator  SA   hand over the  My New App REG  file along with the application  and ask the SA to install this REG file  once done  as admin  this would create the key for your applicaion   4  Run your application  it should not need to access anything else other than this key   Problem should be resolved by now   Cause   When developing an application that writes anything into the EventLog  it would require a KEY for it under the Eventlog registry if this key isn t found  it would try to create it  which then fails for having no permissions to do so  The above process  is similar to deploying an application  manually  whereas we are creating this ourselves  and no need to have a headache since you are not tweaking the registry by adding permissions to EVERYONE which is a securty risk on production servers   I hope this helps resolving it

User · Answer

There does appear to be a glaringly obvious solution to this that I ve yet to see a huge downside  at least where it s not practical to obtain administrative rights in order to create your own event source  Use one that s already there   The two which I ve started to make use of are   Net Runtime  and  Application Error   both of which seem like they will be present on most machines   Main disadvantages are inability to group by that event  and that you probably don t have an associated Event ID  which means the log entry may very well be prefixed with something to the effect of  The description for Event ID 0 from source  Net Runtime cannot be found      if you omit it  but the log goes in  and the output looks broadly sensible   The resultant code ends up looking like   EventLog WriteEntry        Net Runtime         Some message text here  maybe an exception you want to log       EventLogEntryType Error          Of course  since there s always a chance you re on a machine that doesn t have those event sources for whatever reason  you probably want to try    catch   wrap it in case it fails and makes things worse  but events are now saveable

User · Answer

Though the installer answer is a good answer  it is not always practical when dealing with software you did not write  A simple answer is to create the log and the event source using the PowerShell command New-EventLog  http   technet microsoft com en-us library hh849768 aspx   Run PowerShell as an Administrator and run the following command changing out the log name and source that you need   New-EventLog -LogName Application -Source TFSAggregator  I used it to solve the Event Log Exception when Aggregator runs issue from codeplex

User · Answer

FYI   my problem was that accidently selected  Local Service  as the Account on properties of the ProcessInstaller instead of  Local System    Just mentioning for anyone else who followed the MSDN tutorial as the Local Service selection shows first and I wasn t paying close attention

User · Answer

The problem is that the EventLog SourceExists tries to access the EventLog Security key  access which is only permitted for an administrator   A common example for a C  Program logging into EventLog is   string sSource  string sLog  string sEvent   sSource    dotNET Sample App   sLog    Application   sEvent    Sample Event    if   EventLog SourceExists sSource       EventLog CreateEventSource sSource  sLog    EventLog WriteEntry sSource  sEvent   EventLog WriteEntry sSource  sEvent  EventLogEntryType Warning  234     However  the following lines fail if the program hasn t administrator permissions and the key is not found under EventLog Application as EventLog SourceExists will then try to access EventLog Security   if   EventLog SourceExists sSource       EventLog CreateEventSource sSource  sLog     Therefore the recommended way is to create an install script  which creates the corresponding key  namely      HKEY LOCAL MACHINE SYSTEM CurrentControlSet Services EventLog Application dotNET Sample App   One can then remove those two lines   You can also create a  reg file to create the registry key  Simply save the following text into a file create reg   Windows Registry Editor Version 5 00   HKEY LOCAL MACHINE SYSTEM CurrentControlSet Services EventLog Application dotNET Sample App

User · Answer

Solution is very simple - Run Visual Studio Application in Admin mode

User · Answer

The solution was to give the  Network Service  account read permission on the EventLog Security key

User · Answer

Same issue on Windows 7 64bits  Run as administrator solved the problem

[asp.net] System.Security.SecurityException when writing to Event Log

Examples related to asp.net

Examples related to windows

Examples related to iis-7

Examples related to exception-handling

Examples related to event-log