What's the difference between using EventLog .NET type and having eventLog registry entry?

Question

Using System.Diagnostics.EventLog .NET type one can programmatically create logs into the Event Viewer application.

1. Does anybody knows about "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\XXX\" registry entry?

2. Who uses this assembly and how it is used?

3. What is the preferred method? Using EventLog type or the registry entry? Or is this question even valid?

-Datte

Answer 1

I prefer using the EventLogInstaller and create the event log sources using installutil explicitly.

About who uses the assembly, I guess whoever wants to write to the EventLog. Keep in mind that there are other ways to write to the EventLog from .NET applications that use instrumentation manifests. Take a look at the System.Diagnostics.Eventing namespace.

Answer 2

Basicaly Event Logging service uses "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\" key to store configuration variables for each event source (i.e. location of the log files). In fact the actual logs are stored in these files.

So I believe it is possible to update the registry and manage the log file yourself but it is not a good idea at all. I'd prefer using the API.

You can check here for details: http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx