Web App. Writing to Custom Event Log

[anonim1]

I've tried unsuccessfully for the past two days to get my web application to write to a custom event log. I can write to the log if I create a console app. and run it as an Administrator, but it doesn't work from inside a web application.

I have impersonation=true, so everything is running under the IUSR_machinename account. I've given this account rights to the registry key, the custom event log's .evt file, etc. Even if I make the IUSR account a member of the Administrators group, I cannot write to the log. I get the error:

[Win32Exception (0x80004005): Access is denied]

[InvalidOperationException: Cannot open log for source {0}. You may not have write access.]

I used Regmon and Filemon to see what was going on...

Filemon:
w3wp.exe:4008	OPEN	D:\Inetpub\BETA\Survey\test.aspx	SUCCESS	Options: Open  Access: All	
w3wp.exe:4008	QUERY SECURITY	D:\Inetpub\BETA\Survey\test.aspx	BUFFER OVERFLOW
w3wp.exe:4008	QUERY SECURITY	D:\Inetpub\BETA\Survey\test.aspx	SUCCESS
w3wp.exe:4008	CLOSE	D:\Inetpub\BETA\Survey\test.aspx	SUCCESS

Regmon:
w3wp.exe:4008	OpenKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\Application	SUCCESS
w3wp.exe:4008	OpenKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\Application\Enterprise Library Logging Service	NOT FOUND
w3wp.exe:4008	CloseKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\Application	SUCCESS
w3wp.exe:4008	OpenKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\AspNet	SUCCESS
w3wp.exe:4008	OpenKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\AspNet\Enterprise Library Logging Service	SUCCESS
w3wp.exe:4008	CloseKey	HKLM\SYSTEM\ControlSet001\Services\EventLog	SUCCESS
w3wp.exe:4008	CloseKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\AspNet\Enterprise Library Logging Service	SUCCESS
w3wp.exe:4008	CloseKey	HKLM\SYSTEM\ControlSet001\Services\EventLog\AspNet	SUCCESS

I don't know what the buffer overflow is about, and I don't know why the registry is looking under the Application log when I specify "AspNet" as the log and "Enterprise Library Logging Service" as the source (I created the log and the source as an admin, so I know they exist).

Any ideas? I've done a lot more, but I want to see what suggestions any of you may have... thanks!

anonim

 

[Isadore]

anonim: you may have already tried this but if you do a search at Google - Groups using: "Win32Exception (0x80004005): Access is denied" quite a few discussions came up regarding this error; if you have done this then disregard this suggestion (thought it might help). Personaly have not worked with trying to access web log within a web app.

 

[anonim1]

Isadore,

I did read up a lot of those discussions and performed the proposed solutions (edited CustomSD key in the registry, used InstallUtil.exe to create the log and event source, etc.), but none of them have solved my problem. This should not be such a difficult problem, but I'm confident the resolution will come around soon enough.

anonim

 

[Isadore]

anonim: keep us informed on how it works out; its a very interesting approach and one that I would imagine would be quite useful; post back if you make a breakthrough on this.