Event log messages get overrriden by another event log

Question

I create event logs for asp.net projects error logging. I do it by adding a key in regedit, and then a sub-key.
Sometimes, I create a new key and sub-key, and instead of getting a new, empty event log, I see in the event viewer that it's showing me the logs from a different project. I'm not able to find a pattern as to when this happens.
Has anyone encountered such a problem? Am I doing something wrong?

Answer 1

It seems that the problem was that we had already created an event log with that name, and even though we deleted it, it didn't help. The solution was to create an event log with a different name.

Answer 2

You probably want to use the EventLog.CreateEventSource API to do this - it should take care of any details for you.

A quick read thru the docs seems to show that the 1st 8 characters are checked for uniqueness...perhaps that's where your issue is?

Edit: From Reflector, the API does this...

1. Check for invalid characters ("non printable" based on Unicode category, \, *, ?)
2. Checks that the created reg key will be <= 254 characters
3. Checks if the source is already registered
4. Checks that the log name isn't reserved (AppEvent, SecEvent, SysEvent)
5. Checks for another log with the same beginning 8 chars
6. Checks that the log name doesn't exist as a source
7. Creates the log subkey
8. Initializes the log subkey with default values (MaxSize = 524288, AutoBackupLogFiles = 9. Retention = 604800, File = %SystemRoot%\System32\config\logName.Substring(0, 8) + ".evt")
9. If OS is not > Windows NT 5.x (Vista or higher), creates a multi string value on the logkey with logName and source name. Or, if value exists, appends source name to the existing array.
10. Creates a subkey for source
11. Initializes the source subkey with default values (EventMessageFile, ParameterMessageFile, CategoryMessageFile, CategoryCount)