Windows Server 2008 won't let me create a log source, telling me it already exists (it does not)

Question

I have a small winforms app that creates a new event log source.

I run it as administrator for the elevated privileges.

The code checks to ensure the specified event log does not exist and then creates the source. This worked fine on my Windows 7 machine, but when I run the app on Windows Server 2008 R2 SP1 it tells me the source already exists. I know it doesn't because a) this is a fresh installed of Windows Server 2008 R2, and b) I added code to return a list of all the log sources and my new one was not in the list.

I know about the "first 8 characters" being the significant ones and I made sure my source names was completely unique.

Here's the super-easy code (of course I have try/catches around this):

if (!EventLog.SourceExists(sourceName))
{
    EventLog.CreateEventSource(sourceName, logName);
}

Can anyone tell me why Windows Server 2008 is lying to me?

Answer 1

Local (or domain) administrators are not the most powerful accounts on a Windows box.

There are other accounts that have higher (though also more limited) access.

SourceExists() will return false if it exits but you don't have access rights to know about it, and it's perfectly possible for an administrator to be denied access to something.

Also, there are reserved names for things in odd places that can trip you up. Creating folders with the names CON COM or LPT used to cause odd issues on server 2003.

So there also are a whole bunch of reasons why CreateEventSource() can fail - dig into the inner exception(s) as well, often those provide critical detail.

Which event log source name was failing for you?
Would you post the exception stack?