Event Logging

Mar 27, 2011 at 10:26 PM
Edited Mar 27, 2011 at 10:28 PM

I am using this library to enable event logging and notice that logs are being written to the Application Log and not the SharePoint event log. I used the code documented on MSDN under 

The code I am using to write the event is:
string msg = "Log Message";
eventID = 0;
severity = EventSeverity.Information;
logger.LogToOperations(msg, eventID, severity, ConcatenateAreaCategory(area,loggingCategory)); 

I am glad to see the event bring written to the application event log, but was expecting to see it in the SharePoint event log.

How do I correct this behavior?
Mar 28, 2011 at 7:07 PM

Did you create the windows event source on your server? One thing you can do is to use DiagnosticsAreaEventSource.EnsureConfiguredAreasRegistered to create the event source. You need to run it with admin rights. So either run it in FeatureInstalled event or in a Timer job, or in a Console App. Avoid running it in FeatureActivated event since that may not have high enought rights.




Mar 28, 2011 at 7:23 PM
Edited Mar 28, 2011 at 7:24 PM


Thanks for your post. I see mention of this static method in the MSDN article in my initial post. You are saying that the areas and categories must be registered on the server independently of the feature. 

I am unclear then as to why it would be useful configure the areas and categories in a feature receiver class at all, since in actually logging an event, one can pass in the area/category string directly.

Areas and categories may change over time for  project. Ideally, there should be a way to define the strings and manage them from one source and then reference these when either registering the areas and categories or packaging the feature. Has anyone been able to accomplish this or do most people just copy the strings manually across solutions?



Mar 28, 2011 at 7:51 PM

Windows Event source msut be registered on each and every WFE server in the SharePoint Farm. So if you have a farm envrionment with 2 or 2+ WFE servers, you must not just create the evernt source inside a FeartureInstalled/FeatureActivated event handerler since those evernt only get fired once in one of the WFE servers.  To make sure event source is crated on all WFE servers, you can run a timer job whitch calls DiagnosticsAreaEventSource.EnsureConfiguredAreasRegistered. You can also run a console app in each and every WFE server to create event source.

Areas and category are stored in the SharePoint database, so they only need to be crated once and you can create them in a FeatrueInstalled event handler.

One use of defining Area/Categoy is for the enterprise to used predifined logging tree structure to enoforce standard practices. While we also keep it flexiable for the reason that you just mentioned.

As far as area/category strings, you can use many ways to make them flexible. For example, in the Logging Hands on lab SharePoint Guidance 2010 Hands On Lab, it defines a string constant for area/category so you don't copy the acutaul strings around. I am sure you have ways to make it more flexible.


Aug 30, 2011 at 9:39 AM


I found my event log full of SharePoint development errors, almost one every five seconds!

The script [get-eventlog –logname Application –source ‘*sharepoint*’ –newest 20 | out-gridview]uses PowerShell to get a collection of event entries from the “Application” Event Log.  It passes a wildcard filter for any source like  ‘*sharepoint*’ and then it returns the last 20 entries written to the event log. 
The good thing is that these objects are piped to a gridview. From there, I can apply additional filtering, like:  “Show me all events where ‘user’ is in the message.”