﻿<?xml version="1.0" encoding="utf-8"?><Type Name="EventLog" FullName="System.Diagnostics.EventLog"><TypeSignature Language="C#" Maintainer="auto" Value="public class EventLog : System.ComponentModel.Component, System.ComponentModel.ISupportInitialize" /><TypeSignature Language="ILAsm" Value=".class public auto ansi beforefieldinit EventLog extends System.ComponentModel.Component implements class System.ComponentModel.ISupportInitialize" /><AssemblyInfo><AssemblyName>System</AssemblyName><AssemblyPublicKey>[00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00]</AssemblyPublicKey><AssemblyVersion>1.0.3300.0</AssemblyVersion><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ThreadSafetyStatement>Gtk# is thread aware, but not thread safe; See the &lt;link location="node:gtk-sharp/programming/threads"&gt;Gtk# Thread Programming&lt;/link&gt; for details.</ThreadSafetyStatement><Base><BaseTypeName>System.ComponentModel.Component</BaseTypeName></Base><Interfaces><Interface><InterfaceName>System.ComponentModel.ISupportInitialize</InterfaceName></Interface></Interfaces><Attributes><Attribute><AttributeName>System.ComponentModel.DefaultEvent("EntryWritten")</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.InstallerType(typeof(System.Diagnostics.EventLogInstaller))</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("Represents an event log")</AttributeName></Attribute></Attributes><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para><see cref="T:System.Diagnostics.EventLog" /> lets you access or customize Windows event logs, which record information about important software or hardware events. Using <see cref="T:System.Diagnostics.EventLog" />, you can read from existing logs, write entries to logs, create or delete event sources, delete logs, and respond to log entries. You can also create new logs when creating an event source.</para><block subset="none" type="note"><para>If the <see cref="P:System.Diagnostics.EventLog.Source" /> for the event log associated with the <see cref="T:System.Diagnostics.EventLog" /> instance does not exist, a new event source is created. To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><para /><block subset="none" type="note"><para>Creating an <see cref="T:System.Diagnostics.EventLog" /> object, writing an entry, then passing the <see cref="T:System.Diagnostics.EventLog" /> object to partially trusted code can create a security issue. Never pass any event log object, including <see cref="T:System.Diagnostics.EventLogEntry" /> and <see cref="T:System.Diagnostics.EventLogEntryCollection" /> objects, to less trusted code.</para></block><block subset="none" type="note"><para>In versions 1.0 and 1.1 of the .NET Framework, this class requires immediate callers to be fully trusted. In version 2.0 this class requires <see cref="T:System.Diagnostics.EventLogPermission" /> for specific actions. It is strongly recommended that <see cref="T:System.Diagnostics.EventLogPermission" /> not be granted to partially trusted code.  The ability to read and write the event log allows code to perform actions such as issuing event log messages in the name of another application.</para></block><block subset="none" type="note"><para>Creating or deleting an event source requires synchronization of the underlying code by using a named mutex. If a highly privileged application locks the named mutex, attempts to create or delete an event source causes the application to stop responding until the lock is released. To help avoid this problem, never grant <see cref="F:System.Security.Permissions.SecurityPermissionFlag.UnmanagedCode" /> permission to untrusted code. In addition, <see cref="F:System.Security.Permissions.SecurityPermissionFlag.UnmanagedCode" /> permission potentially allows other permissions to be bypassed and should only be granted to highly trusted code.</para></block><para>To read from a log, specify the <see cref="P:System.Diagnostics.EventLog.Log" /> name and <see cref="P:System.Diagnostics.EventLog.MachineName" /> (server computer name) for the <see cref="T:System.Diagnostics.EventLog" />. It is not necessary to specify the <see cref="P:System.Diagnostics.EventLog.Source" />, as a source is required only for writing to logs. The <see cref="P:System.Diagnostics.EventLog.Entries" /> member is automatically populated with the event log's list of entries.</para><block subset="none" type="note"><para>You are not required to specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log by specifying a <see cref="P:System.Diagnostics.EventLog.Log" /> / <see cref="P:System.Diagnostics.EventLog.MachineName" /> pair. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer, ".", is assumed.</para></block><para>If you write to an event log, you must specify or create an event <see cref="P:System.Diagnostics.EventLog.Source" />. You must have administrative rights on the computer to create a new event source. The <see cref="P:System.Diagnostics.EventLog.Source" /> registers your application with the event log as a valid source of entries. You can only use the <see cref="P:System.Diagnostics.EventLog.Source" /> to write to one log at a time. The <see cref="P:System.Diagnostics.EventLog.Source" /> can be any random string, but the name must be distinct from other sources on the computer. It is common for the source to be the name of the application or another identifying string. An attempt to create a duplicated <see cref="P:System.Diagnostics.EventLog.Source" /> value throws an exception. However, a single event log can be associated with multiple sources.</para><block subset="none" type="note"><para>There is nothing to protect an application from writing as any registered source.  If an application is granted <see cref="F:System.Diagnostics.EventLogPermissionAccess.Write" /> permission, it can write events for any valid source registered on the computer.</para></block><para>Applications and services should write to the Application log or a custom log. Device drivers should write to the System log. If you do not explicitly set the <see cref="P:System.Diagnostics.EventLog.Log" /> property, the event log defaults to the Application log.</para><block subset="none" type="note"><para>The Security log is read-only.</para></block><para>Use <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> and <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files. To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.</para><para>You can register the event source with localized resources for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string values. Refer to the <see cref="T:System.Diagnostics.EventLogInstaller" /> and <see cref="T:System.Diagnostics.EventSourceCreationData" /> classes for more information on configuring your source with resource files.</para><para>If your application writes string values directly to the event log, you do not need to set the resource file properties for the source. The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><para>When writing events, you must at least specify either a message string or the resource identifier for a message string. Other event properties are optional. Examples of optional event settings include the following: you can set the <see cref="T:System.Diagnostics.EventLogEntryType" /> to specify the icon that the Event Viewer displays for the entry; you can specify a category identifier for the event, if your application uses categories for filtering the events; and you can also attach binary data to your event entry if you need to associate additional information with a given event.</para><para>In addition to accessing individual event logs and their entries, the <see cref="T:System.Diagnostics.EventLog" /> class provides access to the collection of all event logs. You can use the static members of <see cref="T:System.Diagnostics.EventLog" /> to delete logs, get log lists, create or delete a source, or determine if a computer already contains a particular source.</para><para>There are three default event logs: Application, System, and Security. Other installed applications and services, such as Active Directory, can have additional event logs. You can use <see cref="T:System.Diagnostics.EventLog" /> to create custom event logs that you can view through the server's Event Viewer. Use the <see cref="M:System.Diagnostics.EventLog.RegisterDisplayName(System.String,System.Int64)" /> method to display a localized name for your event log in the Event Viewer. Use the <see cref="M:System.Diagnostics.EventLog.ModifyOverflowPolicy(System.Diagnostics.OverflowAction,System.Int32)" /> method to configure the behavior of your event log when it reaches its maximum log size.</para><para>Event logging consumes disk space, processor time, and other system resources. It is important to log only essential information. It is recommended that you place event log calls in an error path, rather than in the main code path, so as not to adversely affect performance.</para><para>For a list of initial property values for an instance of <see cref="T:System.Diagnostics.EventLog" />, see the <see cref="M:System.Diagnostics.EventLog.#ctor" /> constructor.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Provides interaction with Windows event logs. </para></summary></Docs><Members><Member MemberName=".ctor"><MemberSignature Language="C#" Value="public EventLog ();" /><MemberSignature Language="ILAsm" Value=".method public hidebysig specialname rtspecialname instance void .ctor() cil managed" /><MemberType>Constructor</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue /><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Before calling <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, specify the <see cref="P:System.Diagnostics.EventLog.Source" /> property of the <see cref="T:System.Diagnostics.EventLog" /> instance. If you are only reading <see cref="P:System.Diagnostics.EventLog.Entries" /> from the log, you can alternatively specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> properties.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer (".") is assumed.</para></block><para>The following table shows initial property values for an instance of <see cref="T:System.Diagnostics.EventLog" />.</para><list type="table"><listheader><item><term><para>Property </para></term><description><para>Initial Value </para></description></item></listheader><item><term><para><see cref="P:System.Diagnostics.EventLog.Source" /></para></term><description><para>An empty string (""). </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.Log" /></para></term><description><para>An empty string (""). </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.MachineName" /></para></term><description><para>The local computer ("."). </para></description></item></list></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Initializes a new instance of the <see cref="T:System.Diagnostics.EventLog" /> class. Does not associate the instance with any log.</para></summary></Docs></Member><Member MemberName=".ctor"><MemberSignature Language="C#" Value="public EventLog (string logName);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig specialname rtspecialname instance void .ctor(string logName) cil managed" /><MemberType>Constructor</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue /><Parameters><Parameter Name="logName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>This overload sets the <see cref="P:System.Diagnostics.EventLog.Log" /> property to the <paramref name="logName" /> parameter. Before calling <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, specify the <see cref="P:System.Diagnostics.EventLog.Source" /> property of the <see cref="T:System.Diagnostics.EventLog" /> instance. If you are only reading <see cref="P:System.Diagnostics.EventLog.Entries" /> from the log, you can alternatively specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> properties.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer (".") is assumed. This overload of the constructor specifies the <see cref="P:System.Diagnostics.EventLog.Log" /> property, but you can change this before reading the <see cref="P:System.Diagnostics.EventLog.Entries" /> property.</para></block><para>If the source you specify in the <see cref="P:System.Diagnostics.EventLog.Source" /> property is unique from other sources on the computer, a subsequent call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> creates a log with the specified name, if it does not already exist.</para><para>The following table shows initial property values for an instance of <see cref="T:System.Diagnostics.EventLog" />.</para><list type="table"><listheader><item><term><para>Property </para></term><description><para>Initial Value </para></description></item></listheader><item><term><para><see cref="P:System.Diagnostics.EventLog.Source" /></para></term><description><para>An empty string (""). </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.Log" /></para></term><description><para>The <paramref name="logName" /> parameter. </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.MachineName" /></para></term><description><para>The local computer ("."). </para></description></item></list></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Initializes a new instance of the <see cref="T:System.Diagnostics.EventLog" /> class. Associates the instance with a log on the local computer.</para></summary><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log on the local computer. </param></Docs></Member><Member MemberName=".ctor"><MemberSignature Language="C#" Value="public EventLog (string logName, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig specialname rtspecialname instance void .ctor(string logName, string machineName) cil managed" /><MemberType>Constructor</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue /><Parameters><Parameter Name="logName" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>This overload sets the <see cref="P:System.Diagnostics.EventLog.Log" /> property to the <paramref name="logName" /> parameter and the <see cref="P:System.Diagnostics.EventLog.MachineName" /> property to the <paramref name="machineName" /> parameter. Before calling <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, specify the <see cref="P:System.Diagnostics.EventLog.Source" /> property of the <see cref="T:System.Diagnostics.EventLog" />. If you are only reading <see cref="P:System.Diagnostics.EventLog.Entries" /> from the log, you can alternatively specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> properties.</para><block subset="none" type="note"><para>This overload of the constructor specifies the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> properties, but you can change either before reading the <see cref="P:System.Diagnostics.EventLog.Entries" /> property.</para></block><para>The following table shows initial property values for an instance of <see cref="T:System.Diagnostics.EventLog" />.</para><list type="table"><listheader><item><term><para>Property </para></term><description><para>Initial Value </para></description></item></listheader><item><term><para><see cref="P:System.Diagnostics.EventLog.Source" /></para></term><description><para>An empty string (""). </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.Log" /></para></term><description><para>The <paramref name="logName" /> parameter. </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.MachineName" /></para></term><description><para>The <paramref name="machineName" /> parameter. </para></description></item></list></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Initializes a new instance of the <see cref="T:System.Diagnostics.EventLog" /> class. Associates the instance with a log on the specified computer.</para></summary><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log on the specified computer. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The computer on which the log exists. </param></Docs></Member><Member MemberName=".ctor"><MemberSignature Language="C#" Value="public EventLog (string logName, string machineName, string source);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig specialname rtspecialname instance void .ctor(string logName, string machineName, string source) cil managed" /><MemberType>Constructor</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue /><Parameters><Parameter Name="logName" Type="System.String" /><Parameter Name="machineName" Type="System.String" /><Parameter Name="source" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>This constructor sets the <see cref="P:System.Diagnostics.EventLog.Log" /> property to the <paramref name="logName" /> parameter, the <see cref="P:System.Diagnostics.EventLog.MachineName" /> property to the <paramref name="machineName" /> parameter, and the <see cref="P:System.Diagnostics.EventLog.Source" /> property to the <paramref name="source" /> parameter. The <see cref="P:System.Diagnostics.EventLog.Source" /> property is required when writing to an event log. However, if you are only reading from an event log, only the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> properties are required (as long as the event log on the server has a source already associated with it). If you are only reading from the event log, another overload of the constructor might suffice.</para><para>The following table shows initial property values for an instance of <see cref="T:System.Diagnostics.EventLog" />.</para><list type="table"><listheader><item><term><para>Property </para></term><description><para>Initial Value </para></description></item></listheader><item><term><para><see cref="P:System.Diagnostics.EventLog.Source" /></para></term><description><para>The <paramref name="source" /> parameter. </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.Log" /></para></term><description><para>The <paramref name="logName" /> parameter. </para></description></item><item><term><para><see cref="P:System.Diagnostics.EventLog.MachineName" /></para></term><description><para>The <paramref name="machineName" /> parameter. </para></description></item></list></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Initializes a new instance of the <see cref="T:System.Diagnostics.EventLog" /> class. Associates the instance with a log on the specified computer and creates or assigns the specified source to the <see cref="T:System.Diagnostics.EventLog" />.</para></summary><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log on the specified computer </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The computer on which the log exists. </param><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source of event log entries. </param></Docs></Member><Member MemberName="BeginInit"><MemberSignature Language="C#" Value="public void BeginInit ();" /><MemberSignature Language="ILAsm" Value=".method public hidebysig newslot virtual instance void BeginInit() cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The vsprvslong design environment uses this method to start the initialization of a component used on a form or by another component. The <see cref="M:System.Diagnostics.EventLog.EndInit" /> method ends the initialization. Using the <see cref="M:System.Diagnostics.EventLog.BeginInit" /> and <see cref="M:System.Diagnostics.EventLog.EndInit" /> methods prevent the control from being used before it is fully initialized.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Begins the initialization of an <see cref="T:System.Diagnostics.EventLog" /> used on a form or used by another component. The initialization occurs at runtime.</para></summary></Docs></Member><Member MemberName="Clear"><MemberSignature Language="C#" Value="public void Clear ();" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void Clear() cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Event logs are set with a maximum size that determines how many entries they can contain. When an event log is full, it stops recording new event information or begins to overwrite earlier entries. If event recording stops, you can use this method to clear the log of existing entries and allow it to start recording events again. You must have administrator permissions to the computer on which the log resides to clear event log entries.</para><para><see cref="M:System.Diagnostics.EventLog.Clear" /> closes the event log, releases the event handles, retrieves new read and write handles, and reopens the event log. Events received after the call to the method are not cleared along with the existing events.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Removes all entries from the event log.</para></summary></Docs></Member><Member MemberName="Close"><MemberSignature Language="C#" Value="public void Close ();" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void Close() cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The <see cref="M:System.Diagnostics.EventLog.Close" /> method is called by the protected <see cref="M:System.ComponentModel.Component.Dispose" /> method. You do not need to invoke <see cref="M:System.Diagnostics.EventLog.Close" /> before calling <see cref="M:System.ComponentModel.Component.Dispose" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Closes the event log and releases read and write handles.</para></summary></Docs></Member><Member MemberName="CreateEventSource"><MemberSignature Language="C#" Value="public static void CreateEventSource (System.Diagnostics.EventSourceCreationData sourceData);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void CreateEventSource(class System.Diagnostics.EventSourceCreationData sourceData) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="sourceData" Type="System.Diagnostics.EventSourceCreationData" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this overload to configure a new source for writing entries to an event log on the local computer or a remote computer. It is not necessary to use this method to read from an event log.</para><para>The <see cref="M:System.Diagnostics.EventLog.CreateEventSource(System.Diagnostics.EventSourceCreationData)" /> method uses the input <paramref name="sourceData" /><see cref="P:System.Diagnostics.EventSourceCreationData.Source" />, <see cref="P:System.Diagnostics.EventSourceCreationData.LogName" /> and <see cref="P:System.Diagnostics.EventSourceCreationData.MachineName" /> properties to create registry values on the target computer for the new source and its associated event log. A new source name cannot match an existing source name or an existing event log name on the target computer. If the <see cref="P:System.Diagnostics.EventSourceCreationData.LogName" /> property is not set, the source is registered for the Application event log. If the <see cref="P:System.Diagnostics.EventSourceCreationData.MachineName" /> is not set, the source is registered on the local computer.</para><block subset="none" type="note"><para>To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><para /><para>Use <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> and <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.</para><para>The operating system stores event logs as files. When you use <see cref="T:System.Diagnostics.EventLogInstaller" /> or <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the <see cref="P:System.Diagnostics.EventLog.Log" /> property with the ".evt" file name extension.</para><para>Each source can only write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.</para><para>You can register the event source with localized resource file(s) for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string. The Event Viewer uses the resource identifier to find and display the corresponding string from the localized resource file based on current language settings. You can register a separate file for event categories, messages and parameter insertion strings, or you can register the same resource file for all three types of strings. Use the <see cref="P:System.Diagnostics.EventSourceCreationData.CategoryCount" />, <see cref="P:System.Diagnostics.EventSourceCreationData.CategoryResourceFile" />, <see cref="P:System.Diagnostics.EventSourceCreationData.MessageResourceFile" />, and <see cref="P:System.Diagnostics.EventSourceCreationData.ParameterResourceFile" /> properties to configure the source to write localized entries to the event log. If your application writes strings values directly to the event log, you do not need to set these properties.</para><para>The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><para>To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.</para><block subset="none" type="note"><para>If a source is configured for an event log, and you reconfigure it for another event log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Establishes a valid event source for writing localized event messages, using the specified configuration properties for the event source and the corresponding event log.</para></summary><param name="sourceData"><attribution license="cc4" from="Microsoft" modified="false" />The configuration properties for the event source and its target event log. </param></Docs></Member><Member MemberName="CreateEventSource"><MemberSignature Language="C#" Value="public static void CreateEventSource (string source, string logName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void CreateEventSource(string source, string logName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="logName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this overload to create a custom log or to create and register a <see cref="P:System.Diagnostics.EventLog.Source" /> to an existing log on the local computer.</para><para>If <paramref name="logName" /> is null or an empty string ("") when you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" />, the log defaults to the Application log. If the log does not exist on the local computer, the system creates a custom log and registers your application as a <see cref="P:System.Diagnostics.EventLog.Source" /> for that log.</para><block subset="none" type="note"><para>To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><para /><para>You only need to create an event source if you are writing to the event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the <see cref="P:System.Diagnostics.EventLog.Source" /> to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the <see cref="P:System.Diagnostics.EventLog.Source" />, or a <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" />.</para><block subset="none" type="note"><para>You are not required to specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log on the local computer. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> when reading from a log, the local computer (".") is assumed.</para></block><para>Use <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> and <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.</para><para>The operating system stores event logs as files. When you use <see cref="T:System.Diagnostics.EventLogInstaller" /> or <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the <see cref="P:System.Diagnostics.EventLog.Log" /> property with the ".evt" file name extension.</para><para>The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.</para><para>The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><para>To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.</para><block subset="none" type="note"><para>If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Establishes the specified source name as a valid event source for writing entries to a log on the local computer. This method can also create a new custom log on the local computer.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source name by which the application is registered on the local computer. </param><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log. </param></Docs></Member><Member MemberName="CreateEventSource"><MemberSignature Language="C#" Value="public static void CreateEventSource (string source, string logName, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void CreateEventSource(string source, string logName, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.Obsolete("use CreateEventSource(EventSourceCreationData) instead")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="logName" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this overload to create a custom log or to create and register a <see cref="P:System.Diagnostics.EventLog.Source" /> to an existing log on the specified computer.</para><para>If <paramref name="logName" /> is null or an empty string ("") when you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" />, the log defaults to the Application log. If the log does not exist on the specified computer, the system creates a custom log and registers your application as a <see cref="P:System.Diagnostics.EventLog.Source" /> for that log.</para><para>You only need to create an event source if you are writing to the event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the <see cref="P:System.Diagnostics.EventLog.Source" /> to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the <see cref="P:System.Diagnostics.EventLog.Source" />, or a <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" />.</para><block subset="none" type="note"><para>To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. In Windows Vista and later, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><para /><para>Use <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> and <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.</para><para>The operating system stores event logs as files. When you use <see cref="T:System.Diagnostics.EventLogInstaller" /> or <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the <see cref="P:System.Diagnostics.EventLog.Log" /> property with the ".evt" file name extension.</para><para>The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.</para><para>The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><para>To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.</para><block subset="none" type="note"><para>If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Establishes the specified source name as a valid event source for writing entries to a log on the specified computer. This method can also be used to create a new custom log on the specified computer.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log. If you do not specify a value, <paramref name="logName" /> defaults to Application. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the computer to register this event source with, or "." for the local computer. </param></Docs></Member><Member MemberName="Delete"><MemberSignature Language="C#" Value="public static void Delete (string logName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void Delete(string logName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="logName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method when the log you want to delete is on the local computer. You can delete any log on the computer, provided you have the appropriate registry permissions.</para><para><see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> removes the log specified by <paramref name="logName" /> from the local computer. If you want to delete only the source registered to a log, call <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" />. If you only want to delete the log entries, call <see cref="M:System.Diagnostics.EventLog.Clear" />. <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> are static methods, so they can be called on the class itself. It is not necessary to create a new instance of <see cref="T:System.Diagnostics.EventLog" /> to call either method.</para><para>The <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> method first deletes the file that holds the contents of the log. It then accesses the registry and removes all the event sources registered for that log. If you recreate the log at a later point, you should register the event sources again, if they are to be reused. If you do not register the event sources and other users write to an event source without specifying a log name, the event source will be created in the Application event log. Therefore, applications that previously were able to write entries to the log you deleted and recreated will write to the Application log instead, because it now contains the event source.</para><block subset="none" type="note"><para>Recreating an event log can be a difficult process. Avoid deleting any of the system-created event logs, such as the Application log.</para></block><para>Deleting a log through a call to <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> automatically deletes the sources registered to that log. This can make other applications using that log inoperative.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Removes an event log from the local computer.</para></summary><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the computer. </param></Docs></Member><Member MemberName="Delete"><MemberSignature Language="C#" Value="public static void Delete (string logName, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void Delete(string logName, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="logName" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method when the log you want to delete is on a remote computer. You can delete any log on the computer, provided you have the appropriate registry permissions.</para><para><see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> removes the log specified by <paramref name="logName" /> from the computer specified by <paramref name="machineName" />. If you want to delete only the source registered to a log, call <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" />. If you only want to delete the log entries, call <see cref="M:System.Diagnostics.EventLog.Clear" />. <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> are static methods, so they can be called on the class itself. It is not necessary to create an instance of <see cref="T:System.Diagnostics.EventLog" /> to call either method.</para><para>This method first deletes the file that holds the contents of the log. It then accesses the registry and removes all the event sources registered for that log. If you recreate the log at a later point, you should register the event sources again, if they are to be reused. If you do not register the event sources and other users write to an event source without specifying a log name, the event source will be created in the Application event log. Therefore, applications that previously were able to write entries to the log you deleted and recreated will write to the Application log instead, because it now contains the event source.</para><block subset="none" type="note"><para>Recreating an event log can be a difficult process. Avoid deleting any of the system-created event logs, such as the Application log.</para></block><para>Deleting a log through a call to <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> automatically deletes the sources registered to that log. This can make other applications using that log inoperative.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Removes an event log from the specified computer.</para></summary><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the specified computer. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the computer to delete the log from, or "." for the local computer. </param></Docs></Member><Member MemberName="DeleteEventSource"><MemberSignature Language="C#" Value="public static void DeleteEventSource (string source);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void DeleteEventSource(string source) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to remove the registration of a <see cref="P:System.Diagnostics.EventLog.Source" /> from the local computer. <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> accesses the registry on the local computer and removes the registration of your application as a valid source of events.</para><para>You can remove your component as a valid source of events if you no longer need it to write entries to that log. For example, you might do this if you need to change your component from one log to another. Because a source can only be registered to one log at a time, changing the log requires you to remove the current registration.</para><para><see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> removes only the source registered to a log. If you want to remove the log itself, call <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" />. If you only want to delete the log entries, call <see cref="M:System.Diagnostics.EventLog.Clear" />. <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> are static methods, so they can be called on the class itself. It is not necessary to create an instance of <see cref="T:System.Diagnostics.EventLog" /> to call either method.</para><para>Deleting a log through a call to <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> automatically deletes the sources registered to that log. This can make other applications using that log inoperative.</para><block subset="none" type="note"><para>If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Removes the event source registration from the event log of the local computer.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name by which the application is registered in the event log system. </param></Docs></Member><Member MemberName="DeleteEventSource"><MemberSignature Language="C#" Value="public static void DeleteEventSource (string source, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void DeleteEventSource(string source, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this overload to remove the registration of a <see cref="P:System.Diagnostics.EventLog.Source" /> from a remote computer. <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> accesses the registry on the computer specified by <paramref name="machineName" /> and removes the registration of your application as a valid source of events.</para><para>You can remove your component as a valid source of events if you no longer need it to write entries to that log. For example, you might do this if you need to change your component from one log to another. Because a source can only be registered to one log at a time, changing the log requires you to remove the current registration.</para><para><see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> removes only the source registered to a log. If you want to remove the log itself, call <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" />. If you only want to delete the log entries, call <see cref="M:System.Diagnostics.EventLog.Clear" />. <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> are static methods, so they can be called on the class itself. It is not necessary to create an instance of <see cref="T:System.Diagnostics.EventLog" /> to call either method.</para><para>Deleting a log through a call to <see cref="M:System.Diagnostics.EventLog.Delete(System.String)" /> automatically deletes the sources registered to that log. This can make other applications using that log inoperative.</para><block subset="none" type="note"><para>If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Removes the application's event source registration from the specified computer.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name by which the application is registered in the event log system. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the computer to remove the registration from, or "." for the local computer. </param></Docs></Member><Member MemberName="Dispose"><MemberSignature Language="C#" Value="protected override void Dispose (bool disposing);" /><MemberSignature Language="ILAsm" Value=".method familyhidebysig virtual instance void Dispose(bool disposing) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="disposing" Type="System.Boolean" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>This method is called by the public Dispose() method and the <see cref="M:System.Object.Finalize" /> method. Dispose() invokes the protected Dispose(Boolean) method with the <paramref name="disposing" /> parameter set to true. <see cref="M:System.Object.Finalize" /> invokes Dispose with <paramref name="disposing" /> set to false.</para><para>When the <paramref name="disposing" /> parameter is true, this method releases all resources held by any managed objects that this <see cref="T:System.Diagnostics.EventLog" /> references. This method invokes the Dispose() method of each referenced object.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Releases the unmanaged resources used by the <see cref="T:System.Diagnostics.EventLog" />, and optionally releases the managed resources. </para></summary><param name="disposing"><attribution license="cc4" from="Microsoft" modified="false" />true to release both managed and unmanaged resources; false to release only unmanaged resources.</param></Docs></Member><Member MemberName="EnableRaisingEvents"><MemberSignature Language="C#" Value="public bool EnableRaisingEvents { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance bool EnableRaisingEvents" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.DefaultValue(false)</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("If enabled raises event when a log is written.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Boolean</ReturnType></ReturnValue><Parameters></Parameters><Docs><value>To be added: an object of type 'bool'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The <see cref="P:System.Diagnostics.EventLog.EnableRaisingEvents" /> property determines whether the <see cref="T:System.Diagnostics.EventLog" /> raises events when entries are written to the log. When the property is true, components that receive the <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event will receive notification any time an entry is written to the log that is specified in the <see cref="P:System.Diagnostics.EventLog.Log" /> property. If <see cref="P:System.Diagnostics.EventLog.EnableRaisingEvents" /> is false, no events are raised.</para><block subset="none" type="note"><para>You can receive event notifications only when entries are written on the local computer. You cannot receive notifications for entries written on remote computers.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets a value indicating whether the <see cref="T:System.Diagnostics.EventLog" /> receives <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event notifications.</para></summary></Docs></Member><Member MemberName="EndInit"><MemberSignature Language="C#" Value="public void EndInit ();" /><MemberSignature Language="ILAsm" Value=".method public hidebysig newslot virtual instance void EndInit() cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The vsprvslong design environment uses this method to end the initialization of a component used on a form or by another component. The <see cref="M:System.Diagnostics.EventLog.BeginInit" /> method starts the initialization. Using the <see cref="M:System.Diagnostics.EventLog.BeginInit" /> and <see cref="M:System.Diagnostics.EventLog.EndInit" /> methods prevents the control from being used before it is fully initialized.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Ends the initialization of an <see cref="T:System.Diagnostics.EventLog" /> used on a form or by another component. The initialization occurs at runtime.</para></summary></Docs></Member><Member MemberName="Entries"><MemberSignature Language="C#" Value="public System.Diagnostics.EventLogEntryCollection Entries { get; }" /><MemberSignature Language="ILAsm" Value=".property instance class System.Diagnostics.EventLogEntryCollection Entries" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.DesignerSerializationVisibility(System.ComponentModel.DesignerSerializationVisibility.Hidden)</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("The entries in the log.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Diagnostics.EventLogEntryCollection</ReturnType></ReturnValue><Docs><value>To be added: an object of type 'EventLogEntryCollection'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use the <see cref="P:System.Diagnostics.EventLog.Entries" /> member when reading from the event log.</para><para>Because the property is read-only, you cannot modify an entry or write to the log using <see cref="P:System.Diagnostics.EventLog.Entries" />. Instead, specify a <see cref="P:System.Diagnostics.EventLog.Source" /> and call <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write a new log entry. You can use <see cref="P:System.Diagnostics.EventLog.Entries" /> to count the number of entries in the event log, and view each <see cref="T:System.Diagnostics.EventLogEntry" /> in the collection. Use the indexed <see cref="P:System.Diagnostics.EventLogEntryCollection.Item(System.Int32)" /> member to retrieve information about a specific entry, such as <see cref="P:System.Diagnostics.EventLogEntry.Message" />, <see cref="P:System.Diagnostics.EventLogEntry.Category" />, <see cref="P:System.Diagnostics.EventLogEntry.TimeWritten" />, or <see cref="P:System.Diagnostics.EventLogEntry.EntryType" />.</para><para>It is not necessary to specify a <see cref="P:System.Diagnostics.EventLog.Source" /> when only reading from a log. You can specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> name and <see cref="P:System.Diagnostics.EventLog.MachineName" /> (server computer name) properties for the <see cref="T:System.Diagnostics.EventLog" /> instance. In either case, the <see cref="P:System.Diagnostics.EventLog.Entries" /> member is automatically populated with the event log's list of entries. You can select the appropriate index for an item in this list to read individual entries.</para><para>An important distinction between reading and writing log entries is that it is not necessary to explicitly call a read method. After the <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" /> are specified, the <see cref="P:System.Diagnostics.EventLog.Entries" /> property is automatically populated. If you change the value of the <see cref="P:System.Diagnostics.EventLog.Log" /> or <see cref="P:System.Diagnostics.EventLog.MachineName" /> property, the <see cref="P:System.Diagnostics.EventLog.Entries" /> property is repopulated the next time you read it.</para><block subset="none" type="note"><para>You are not required to specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer, ".", is assumed.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets the contents of the event log.</para></summary></Docs></Member><Member MemberName="EntryWritten"><MemberSignature Language="C#" Value="public event System.Diagnostics.EntryWrittenEventHandler EntryWritten;" /><MemberSignature Language="ILAsm" Value=".event class System.Diagnostics.EntryWrittenEventHandler EntryWritten" /><MemberType>Event</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("Raised for each EventLog entry written.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Diagnostics.EntryWrittenEventHandler</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>To get event notifications, you must set <see cref="P:System.Diagnostics.EventLog.EnableRaisingEvents" /> to true. You can only receive event notifications when entries are written on the local computer. You cannot receive notifications for entries written on remote computers.</para><para>When you create an <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> delegate, you identify the method that will handle the event. To associate the event with your event handler, add an instance of the delegate to the event. The event handler is called whenever the event occurs, until you remove the delegate. For more information about handling events with delegates, see <format type="text/html"><a href="01e4f1bc-e55e-413f-98c7-6588493e5f67">Consuming Events</a></format>.</para><para>The system responds to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> only if the last write event occurred at least six seconds previously. This implies you will only receive one <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event notification within a six-second interval, even if more than one event log change occurs. If you insert a sufficiently long sleep interval (around 10 seconds) between calls to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, you are less likely to miss an event. However, if write events occur more frequently, you might not recieve the event notification until the next interval. Typically, missed event notifications are not lost, but delayed.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Occurs when an entry is written to an event log on the local computer.</para></summary></Docs></Member><Member MemberName="Exists"><MemberSignature Language="C#" Value="public static bool Exists (string logName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig bool Exists(string logName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Boolean</ReturnType></ReturnValue><Parameters><Parameter Name="logName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to determine if a log exists on the local computer. If you want to determine whether a source exists on the local computer, use <see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" />.</para><para>Because this method accesses the registry, you must have the appropriate registry permissions on the local computer; otherwise, the query returns false.</para><para>Because you cannot give a new log the name of an existing log on the same computer, use this method before creating a new log to determine if the specified <paramref name="logName" /> already exists on the local computer. The <paramref name="logName" /> parameter is not case sensitive.</para><para><see cref="M:System.Diagnostics.EventLog.Exists(System.String)" /> is a static method, so it can be called on the class itself. It is not necessary to create an instance of <see cref="T:System.Diagnostics.EventLog" /> to call <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Determines whether the log exists on the local computer.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>true if the log exists on the local computer; otherwise, false.</para></returns><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the log to search for. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer. </param></Docs></Member><Member MemberName="Exists"><MemberSignature Language="C#" Value="public static bool Exists (string logName, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig bool Exists(string logName, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Boolean</ReturnType></ReturnValue><Parameters><Parameter Name="logName" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to determine if a log exists on a remote computer. If you want to determine whether a source exists on a remote computer, use <see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" />.</para><para>Because this method accesses the registry, you must have the appropriate registry permissions on the specified computer; otherwise, the query returns false.</para><para>Because you cannot give a new log the name of an existing log on the same computer, use this method before creating a new log to determine if one with the specified <paramref name="logName" /> already exists on the server specified by the <paramref name="machineName" /> parameter. The <paramref name="logName" /> and <paramref name="machineName" /> parameters are not case sensitive.</para><para><see cref="M:System.Diagnostics.EventLog.Exists(System.String)" /> is a static method, so it can be called on the class itself. It is not necessary to create a new instance of <see cref="T:System.Diagnostics.EventLog" /> to call <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Determines whether the log exists on the specified computer.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>true if the log exists on the specified computer; otherwise, false.</para></returns><param name="logName"><attribution license="cc4" from="Microsoft" modified="false" />The log for which to search. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the computer on which to search for the log, or "." for the local computer. </param></Docs></Member><Member MemberName="GetEventLogs"><MemberSignature Language="C#" Value="public static System.Diagnostics.EventLog[] GetEventLogs ();" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig class System.Diagnostics.EventLog[] GetEventLogs() cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Diagnostics.EventLog[]</ReturnType></ReturnValue><Parameters /><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The array of <see cref="T:System.Diagnostics.EventLog" /> objects is a snapshot of all event logs on the local computer when the call to <see cref="M:System.Diagnostics.EventLog.GetEventLogs" /> is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the local computer, they will appear in the array as well.</para><para>To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Searches for all event logs on the local computer and creates an array of <see cref="T:System.Diagnostics.EventLog" /> objects that contain the list.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>An array of type <see cref="T:System.Diagnostics.EventLog" /> that represents the logs on the local computer.</para></returns></Docs></Member><Member MemberName="GetEventLogs"><MemberSignature Language="C#" Value="public static System.Diagnostics.EventLog[] GetEventLogs (string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig class System.Diagnostics.EventLog[] GetEventLogs(string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Diagnostics.EventLog[]</ReturnType></ReturnValue><Parameters><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The array of <see cref="T:System.Diagnostics.EventLog" /> objects is a snapshot of all event logs on the computer specified by the <paramref name="machineName" /> parameter when the call to <see cref="M:System.Diagnostics.EventLog.GetEventLogs" /> is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the specified computer, they will appear in the array as well.</para><para><see cref="M:System.Diagnostics.EventLog.GetEventLogs" /> is a static method, so it can be called on the <see cref="T:System.Diagnostics.EventLog" /> class itself. It is not necessary to create an instance of an <see cref="T:System.Diagnostics.EventLog" /> object to make a call to the method.</para><para>To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" /> and <see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Searches for all event logs on the given computer and creates an array of <see cref="T:System.Diagnostics.EventLog" /> objects that contain the list.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>An array of type <see cref="T:System.Diagnostics.EventLog" /> that represents the logs on the given computer.</para></returns><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The computer on which to search for event logs. </param></Docs></Member><Member MemberName="Log"><MemberSignature Language="C#" Value="public string Log { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance string Log" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.DefaultValue("")</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.ReadOnly(true)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.RecommendedAsConfigurable(true)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("Name of the log that is read and written.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.String</ReturnType></ReturnValue><Parameters></Parameters><Docs><value>To be added: an object of type 'string'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Three log files exist by default on the server: Application, System, and Security. Applications and services use the Application log file. Device drivers use the System log file. The system generates success and failure audit events in the Security log when auditing is turned on. If you have other applications installed, like Active Directory on Windows servers, there might be other default log files. In addition, you can create custom log files on a local or remote computer. Custom logs help organize your entries in a more detailed way than is allowed when your components write events to the default Application log.</para><block subset="none" type="note"><para>Log names are limited to eight characters. According to the system, MyLogSample1 and MyLogSample2 are the same log.</para></block><para>If you write to an event log, it is not enough to specify the <see cref="P:System.Diagnostics.EventLog.Log" /> property. You must associate a <see cref="P:System.Diagnostics.EventLog.Source" /> property with your event log resource to connect it to a particular log. It is not necessary to specify a <see cref="P:System.Diagnostics.EventLog.Source" /> when only reading from a log, but an event source must be associated with the event log resource in the server's registry. You can specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> name and <see cref="P:System.Diagnostics.EventLog.MachineName" /> (server computer name) to read from it.</para><block subset="none" type="note"><para>You are not required to specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer (".") is assumed.</para></block><para>If the <see cref="P:System.Diagnostics.EventLog.Source" /> property has not been specified, a call to <see cref="P:System.Diagnostics.EventLog.Log" /> returns an empty string if <see cref="P:System.Diagnostics.EventLog.Log" /> has not been explicitly set (by setting the <see cref="P:System.Diagnostics.EventLog.Log" /> property, or through the constructor). If the <see cref="P:System.Diagnostics.EventLog.Source" /> has been specified, <see cref="P:System.Diagnostics.EventLog.Log" /> returns the name of the log to which that source was registered.</para><para>A source can only be registered to one log at a time. If the <see cref="P:System.Diagnostics.EventLog.Source" /> property was set for an instance of <see cref="T:System.Diagnostics.EventLog" />, you cannot change the <see cref="P:System.Diagnostics.EventLog.Log" /> property for that <see cref="T:System.Diagnostics.EventLog" /> without changing the value of <see cref="P:System.Diagnostics.EventLog.Source" /> or calling <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> first. If you change the <see cref="P:System.Diagnostics.EventLog.Log" /> property after the <see cref="P:System.Diagnostics.EventLog.Source" /> property has been set, writing a log entry throws an exception.</para><para>The operating system stores event logs as files. When you use <see cref="T:System.Diagnostics.EventLogInstaller" /> or <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the <see cref="P:System.Diagnostics.EventLog.Log" /> property with the ".evt" file name extension.</para><para>You cannot create a new log using the <see cref="P:System.Diagnostics.EventLog.Log" /> property alone (without specifying a source for the log). You can call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" />, passing in a new log name as a parameter, and then call <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" />. However, the intent is usually either to create (and write entries to) new application-specific logs, or to read from existing logs.</para><para>If the <see cref="P:System.Diagnostics.EventLog.Log" /> value changes, the event log is closed and all event handles are released.</para><block subset="none" type="note"><para>If you set the <see cref="P:System.Diagnostics.EventLog.Log" /> property to the name of a log that does not exist, the system attaches the <see cref="T:System.Diagnostics.EventLog" /> to the Application log, but does not warn you that it is using a log other than the one you specified.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets the name of the log to read from or write to.</para></summary></Docs></Member><Member MemberName="LogDisplayName"><MemberSignature Language="C#" Value="public string LogDisplayName { get; }" /><MemberSignature Language="ILAsm" Value=".property instance string LogDisplayName" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.String</ReturnType></ReturnValue><Docs><value>To be added: an object of type 'string'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><block subset="none" type="note"><para>In Windows Vista and later, users do not have permission to access the security log. If you are running Windows Vista or later as a user, you will get a <see cref="T:System.Security.SecurityException" /> when you attempt to access the display name for an event in the security log.  </para><para>In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets the event log's friendly name.</para></summary></Docs></Member><Member MemberName="LogNameFromSourceName"><MemberSignature Language="C#" Value="public static string LogNameFromSourceName (string source, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig string LogNameFromSourceName(string source, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.String</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The event source indicates what logs the event. It is often the name of the application, or the name of a subcomponent of the application, if the application is large. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.</para><para>When you create a new source, which can only write to one log at a time, the system registers your application with the event log as a valid source of entries. The <see cref="P:System.Diagnostics.EventLog.Source" /> property can be any string, but the name cannot be used by other sources on the computer. An attempt to create a duplicated <see cref="P:System.Diagnostics.EventLog.Source" /> value throws an exception. However, a single event log can have many different sources writing to it.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets the name of the log to which the specified source is registered.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>The name of the log associated with the specified source in the registry.</para></returns><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name of the event source. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name of the computer on which to look, or "." for the local computer. </param></Docs></Member><Member MemberName="MachineName"><MemberSignature Language="C#" Value="public string MachineName { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance string MachineName" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.DefaultValue(".")</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.ReadOnly(true)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.RecommendedAsConfigurable(true)</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("Name of the machine that this log get written to.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.String</ReturnType></ReturnValue><Parameters></Parameters><Docs><value>To be added: an object of type 'string'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>If you write to an event log, you must associate a <see cref="P:System.Diagnostics.EventLog.Source" /> with your event log object to connect it to a particular log. It is not necessary to specify the <see cref="P:System.Diagnostics.EventLog.Source" /> property when only reading from a log. You can specify only the <see cref="P:System.Diagnostics.EventLog.Log" /> name and <see cref="P:System.Diagnostics.EventLog.MachineName" /> (server computer name).</para><block subset="none" type="note"><para>You need not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer (".") is assumed.</para></block><para>A source can only be registered to one log at a time. If the <see cref="P:System.Diagnostics.EventLog.Source" /> property was set for an instance of <see cref="T:System.Diagnostics.EventLog" />, you cannot change the <see cref="P:System.Diagnostics.EventLog.MachineName" /> property for that <see cref="T:System.Diagnostics.EventLog" /> without changing the value of <see cref="P:System.Diagnostics.EventLog.Source" /> or calling <see cref="M:System.Diagnostics.EventLog.DeleteEventSource(System.String)" /> first. If you change the <see cref="P:System.Diagnostics.EventLog.MachineName" /> property, the <see cref="T:System.Diagnostics.EventLog" /> closes all handles and reattaches to the log and source on the new computer.</para><para>The <see cref="P:System.Diagnostics.EventLog.MachineName" /> value cannot be an empty string. If it is not explicitly set, it defaults to the local computer (".").</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets the name of the computer on which to read or write events.</para></summary></Docs></Member><Member MemberName="MaximumKilobytes"><MemberSignature Language="C#" Value="public long MaximumKilobytes { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance int64 MaximumKilobytes" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.DesignerSerializationVisibility(System.ComponentModel.DesignerSerializationVisibility.Hidden)</AttributeName></Attribute><Attribute><AttributeName>System.MonoTODO</AttributeName></Attribute><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Int64</ReturnType></ReturnValue><Docs><value>To be added.</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The <see cref="P:System.Diagnostics.EventLog.MaximumKilobytes" /> property represents the size limit of the event log file. When the event log reaches the size limit, the configured <see cref="P:System.Diagnostics.EventLog.OverflowAction" /> value determines whether new entries are discarded, or whether new entries overwrite older entries.</para><block subset="none" type="note"><para>This property represents a configuration setting for the event log represented by this instance. When the event log reaches its maximum size, this property specifies how the operating system handles new entries written by all event sources registered for the event log.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets the maximum event log size in kilobytes.</para></summary></Docs></Member><Member MemberName="MinimumRetentionDays"><MemberSignature Language="C#" Value="public int MinimumRetentionDays { get; }" /><MemberSignature Language="ILAsm" Value=".property instance int32 MinimumRetentionDays" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.MonoTODO</AttributeName></Attribute><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Int32</ReturnType></ReturnValue><Docs><value>To be added.</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> property to examine the current setting for an event log. Use <see cref="M:System.Diagnostics.EventLog.ModifyOverflowPolicy(System.Diagnostics.OverflowAction,System.Int32)" /> to change the minimum number of days that each entry in the event log must be retained.</para><para>The <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> value depends on the configured overflow behavior of the event log. If the <see cref="T:System.Diagnostics.OverflowAction" /> property for an event log is set to <see cref="F:System.Diagnostics.OverflowAction.OverwriteAsNeeded" />, then the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> value is 0. If the <see cref="T:System.Diagnostics.OverflowAction" /> property for an event log is set to <see cref="F:System.Diagnostics.OverflowAction.DoNotOverwrite" />, then the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> value is -1. If the <see cref="T:System.Diagnostics.OverflowAction" /> property for an event log is set to <see cref="F:System.Diagnostics.OverflowAction.OverwriteOlder" />, then the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> value is greater than zero, and represents the number of days to retain event log entries when the event log is full.</para><para>The overflow behavior only occurs when an event log reaches its size limit. When an <see cref="T:System.Diagnostics.EventLog" /> has its <see cref="P:System.Diagnostics.EventLog.OverflowAction" /> set to <see cref="F:System.Diagnostics.OverflowAction.OverwriteOlder" />, and the event log reaches its maximum size, then new entries are written only if they can replace entries whose age exceeds the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> period. Retaining event entries for a minimum period is appropriate when the event log is archived regularly. Otherwise, you risk losing new entries when the event log reaches its limit. To avoid losing new event information, set the minimum retention days for events based on your archive schedule for a particular event log.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets the number of days to retain entries in the event log.</para></summary></Docs></Member><Member MemberName="ModifyOverflowPolicy"><MemberSignature Language="C#" Value="public void ModifyOverflowPolicy (System.Diagnostics.OverflowAction action, int retentionDays);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void ModifyOverflowPolicy(valuetype System.Diagnostics.OverflowAction action, int32 retentionDays) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoTODO</AttributeName></Attribute><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="action" Type="System.Diagnostics.OverflowAction" /><Parameter Name="retentionDays" Type="System.Int32" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The overflow behavior for an event log specifies what happens when new entries are to be written to a log that has reached its maximum file size.</para><block subset="none" type="note"><para>The overflow behavior takes effect only when an event log reaches its maximum file size. The overflow behavior does not affect writing a new entry to a log that can accommodate additional event log entries.</para></block><para>The <see cref="M:System.Diagnostics.EventLog.ModifyOverflowPolicy(System.Diagnostics.OverflowAction,System.Int32)" /> method configures the overflow behavior of an event log. <see cref="T:System.Diagnostics.EventLog" /> instance. After calling this method for the event log specified by the <see cref="P:System.Diagnostics.EventLog.Log" /> property, the <see cref="P:System.Diagnostics.EventLog.OverflowAction" /> and <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> property values reflect the newly configured overflow behavior.</para><block subset="none" type="note"><para>This property represents a configuration setting for the event log represented by this instance. When the event log reaches its maximum size, this property specifies how the operating system handles new entries written by all event sources registered for the event log.</para></block><para>Set the <paramref name="action" /> parameter to <see cref="F:System.Diagnostics.OverflowAction.OverwriteAsNeeded" /> to indicate that a new entry overwrites the oldest entry when the <see cref="T:System.Diagnostics.EventLog" /> reaches its maximum size. If the <paramref name="action" /> parameter is set to <see cref="F:System.Diagnostics.OverflowAction.OverwriteAsNeeded" />, the <paramref name="retentionDays" /> parameter value is ignored.</para><para>Set the <paramref name="action" /> parameter to <see cref="F:System.Diagnostics.OverflowAction.OverwriteOlder" /> to indicate that each new entry overwrites older entries when the <see cref="T:System.Diagnostics.EventLog" /> reaches its maximum size. Specify the number of days that events must be retained in the log using the <paramref name="retentionDays" /> parameter. Events written within the retention range are not overwritten by new entries.</para><para>Set the <paramref name="action" /> parameter to <see cref="F:System.Diagnostics.OverflowAction.DoNotOverwrite" /> to discard new events when the maximum log size is reached. If the <paramref name="action" /> parameter is set to <see cref="F:System.Diagnostics.OverflowAction.DoNotOverwrite" />, the <paramref name="retentionDays" /> parameter value is ignored.</para><block subset="none" type="note"><para>Setting the overflow policy to <see cref="F:System.Diagnostics.OverflowAction.DoNotOverwrite" /> specifies that new entries are discarded when the event log is full. If you use this setting, ensure the event log is regularly archived and cleared to avoid reaching its maximum size limit.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Changes the configured behavior for writing new entries when the event log reaches its maximum file size.</para></summary><param name="action"><attribution license="cc4" from="Microsoft" modified="false" />The overflow behavior for writing new entries to the event log. </param><param name="retentionDays"><attribution license="cc4" from="Microsoft" modified="false" />The minimum number of days each event log entry is retained. This parameter is used only if <paramref name="action" /> is set to <see cref="F:System.Diagnostics.OverflowAction.OverwriteOlder" />. </param></Docs></Member><Member MemberName="OverflowAction"><MemberSignature Language="C#" Value="public System.Diagnostics.OverflowAction OverflowAction { get; }" /><MemberSignature Language="ILAsm" Value=".property instance valuetype System.Diagnostics.OverflowAction OverflowAction" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.MonoTODO</AttributeName></Attribute><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Diagnostics.OverflowAction</ReturnType></ReturnValue><Docs><value>To be added.</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Event logs grow in size as new events are written to them. Each event log has a configured maximum size limit; the <see cref="P:System.Diagnostics.EventLog.MaximumKilobytes" /> property defines the maximum number of kilobytes allowed for the event log file size.</para><para>Use the <see cref="P:System.Diagnostics.EventLog.OverflowAction" /> property value to examine the configured overflow behavior for an event log at its maximum size. Use the <see cref="M:System.Diagnostics.EventLog.ModifyOverflowPolicy(System.Diagnostics.OverflowAction,System.Int32)" /> method to change the overflow behavior for an event log.</para><block subset="none" type="note"><para>The overflow behavior takes effect only when an event log reaches its maximum file size. The overflow behavior does not affect writing a new entry to a log that can accommodate additional event log entries.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets the configured behavior for storing new entries when the event log reaches its maximum log file size.</para></summary></Docs></Member><Member MemberName="RegisterDisplayName"><MemberSignature Language="C#" Value="public void RegisterDisplayName (string resourceFile, long resourceId);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void RegisterDisplayName(string resourceFile, int64 resourceId) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoTODO</AttributeName></Attribute><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="resourceFile" Type="System.String" /><Parameter Name="resourceId" Type="System.Int64" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use <see cref="M:System.Diagnostics.EventLog.RegisterDisplayName(System.String,System.Int64)" /> to register and display a localized name in the Event Viewer for custom event logs.</para><para>The specified resource identifier must correspond to a localized string defined in the resource file. The Event Viewer displays the custom event log name using the localized string and the current culture settings. For example, you can define multiple event log names localized for different cultures in your resource file. The Event Viewer displays the localized string corresponding to the culture settings of the current user.</para><para>If the Event Viewer cannot load the localized string from the resource file, or if no display name was registered for the event log, then the Event Viewer displays the event log name defined in <see cref="P:System.Diagnostics.EventLog.Log" />.</para><block subset="none" type="note"><para> You do not need to register a display name for the pre-defined event logs. The operating system registers the localized display names for the Application, System, and Security event logs.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Specifies the localized name of the event log, which is displayed in the server Event Viewer.</para></summary><param name="resourceFile"><attribution license="cc4" from="Microsoft" modified="false" />The fully specified path to a localized resource file. </param><param name="resourceId"><attribution license="cc4" from="Microsoft" modified="false" />The resource identifier that indexes a localized string within the resource file. </param></Docs></Member><Member MemberName="Source"><MemberSignature Language="C#" Value="public string Source { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance string Source" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.DefaultValue("")</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.ReadOnly(true)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.RecommendedAsConfigurable(true)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.TypeConverter("System.Diagnostics.Design.StringValueConverter, System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("The application name that writes the log.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.String</ReturnType></ReturnValue><Parameters></Parameters><Docs><value>To be added: an object of type 'string'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>The event source indicates what logs the event. It is often the name of the application, or the name of a subcomponent of the application, if the application is large. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.</para><para>You only need to specify an event source if you are writing to an event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the <see cref="P:System.Diagnostics.EventLog.Source" /> property to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the <see cref="P:System.Diagnostics.EventLog.Source" />, or a <see cref="P:System.Diagnostics.EventLog.Log" /> and <see cref="P:System.Diagnostics.EventLog.MachineName" />.</para><block subset="none" type="note"><para>You are not required to specify the <see cref="P:System.Diagnostics.EventLog.MachineName" /> if you are connecting to a log on the local computer. If you do not specify the <see cref="P:System.Diagnostics.EventLog.MachineName" />, the local computer (".") is assumed.</para></block><para>Use <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> and <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source. </para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.</para><para>The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.</para><para>If you change the <see cref="P:System.Diagnostics.EventLog.Source" /> value, the <see cref="T:System.Diagnostics.EventLog" /> to which it is registered is closed and all event handles are released.</para><para>The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><para>To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.</para><block subset="none" type="note"><para>If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets the source name to register and use when writing to the event log.</para></summary></Docs></Member><Member MemberName="SourceExists"><MemberSignature Language="C#" Value="public static bool SourceExists (string source);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig bool SourceExists(string source) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Boolean</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to determine whether an event source exists on the local computer. If you want to determine whether a log exists on the local computer, use <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" />.</para><para>Because this method accesses the registry, you must have the appropriate registry permissions on the local computer; otherwise, a <see cref="T:System.Security.SecurityException" /> will be thrown.</para><block subset="none" type="note"><para>To search for an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses performance counters, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><block subset="none" type="note"><para>A service that is executing under the <see cref="F:System.ServiceProcess.ServiceAccount.LocalSystem" /> account does not have the privileges required to execute this method. The solution is to check whether the event source exists in the <see cref="T:System.ServiceProcess.ServiceInstaller" />, and if it does not exist, to create the source in the installer.</para></block><para>Because you cannot give a new source the name of an existing source on the same computer, use this method before attempting to call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to ensure that a source with the name specified by <paramref name="source" /> does not already exist on the local computer. The <paramref name="source" /> parameter is not case-sensitive.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Determines whether an event source is registered on the local computer.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>true if the event source is registered on the local computer; otherwise, false.</para></returns><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name of the event source. </param></Docs></Member><Member MemberName="SourceExists"><MemberSignature Language="C#" Value="public static bool SourceExists (string source, string machineName);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig bool SourceExists(string source, string machineName) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.MonoNotSupported("remote machine is not supported")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Boolean</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="machineName" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to determine whether an event source exists on the computer specified by the <paramref name="machineName" /> parameter. If you want to determine whether a log exists on the specified computer, use <see cref="M:System.Diagnostics.EventLog.Exists(System.String)" />.</para><para>Because this method accesses the registry, you must have the appropriate registry permissions on the given server; otherwise, a <see cref="T:System.Security.SecurityException" /> will be thrown.</para><block subset="none" type="note"><para>To search for an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges. </para><para>The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a <see cref="T:System.Security.SecurityException" /> is thrown.</para><para>Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses performance counters, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.</para></block><para /><block subset="none" type="note"><para>A service that is executing under the <see cref="F:System.ServiceProcess.ServiceAccount.LocalSystem" /> account does not have the privileges required to execute this method. The solution is to check whether the event source exists in the <see cref="T:System.ServiceProcess.ServiceInstaller" />, and if it does not exist, to create the source in the installer.</para></block><para>Because you cannot give a new source the name of an existing source on the same computer, use this method before attempting to call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> to ensure that a source with the name specified by <paramref name="source" /> does not already exist on the computer. The <paramref name="source" /> and <paramref name="machineName" /> parameters are not case sensitive.</para><para><see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" /> is a static method, so it can be called on the class itself. It is not necessary to create an instance of <see cref="T:System.Diagnostics.EventLog" /> to call <see cref="M:System.Diagnostics.EventLog.SourceExists(System.String)" />.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Determines whether an event source is registered on a specified computer.</para></summary><returns><attribution license="cc4" from="Microsoft" modified="false" /><para>true if the event source is registered on the given computer; otherwise, false.</para></returns><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name of the event source. </param><param name="machineName"><attribution license="cc4" from="Microsoft" modified="false" />The name the computer on which to look, or "." for the local computer. </param></Docs></Member><Member MemberName="SynchronizingObject"><MemberSignature Language="C#" Value="public System.ComponentModel.ISynchronizeInvoke SynchronizingObject { get; set; }" /><MemberSignature Language="ILAsm" Value=".property instance class System.ComponentModel.ISynchronizeInvoke SynchronizingObject" /><MemberType>Property</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.ComponentModel.Browsable(false)</AttributeName></Attribute><Attribute><AttributeName>System.ComponentModel.DefaultValue(null)</AttributeName></Attribute><Attribute><AttributeName>System.Diagnostics.MonitoringDescription("An object that synchronizes event handler calls.")</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.ComponentModel.ISynchronizeInvoke</ReturnType></ReturnValue><Parameters></Parameters><Docs><value>To be added: an object of type 'ComponentModel.ISynchronizeInvoke'</value><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>When <see cref="P:System.Diagnostics.EventLog.SynchronizingObject" /> is null, methods handling the <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event are called on a thread from the system thread pool. For more information on system thread pools, see <see cref="T:System.Threading.ThreadPool" />.</para><para>When the <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event is handled by a visual Windows Forms component, such as a button, accessing the component through the system thread pool might not work, or might result in an exception. Avoid this by setting <see cref="P:System.Diagnostics.EventLog.SynchronizingObject" /> to a Windows Forms component, which causes the methods handling the <see cref="E:System.Diagnostics.EventLog.EntryWritten" /> event to be called on the same thread on which the component was created.</para><para>If the <see cref="T:System.Diagnostics.EventLog" /> is used inside vsprvslong in a Windows Forms designer, <see cref="P:System.Diagnostics.EventLog.SynchronizingObject" /> is automatically set to the control containing the <see cref="T:System.Diagnostics.EventLog" />. For example, if you place an <see cref="T:System.Diagnostics.EventLog" /> on a designer for Form1 (which inherits from <see cref="T:System.Windows.Forms.Form" />) the <see cref="P:System.Diagnostics.EventLog.SynchronizingObject" /> property of <see cref="T:System.Diagnostics.EventLog" /> is set to the instance of Form1.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Gets or sets the object used to marshal the event handler calls issued as a result of an <see cref="T:System.Diagnostics.EventLog" /> entry written event.</para></summary></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public void WriteEntry (string message);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEntry(string message) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="message" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an information entry to the event log associated with this <see cref="T:System.Diagnostics.EventLog" /> instance. If you want to specify any other <see cref="T:System.Diagnostics.EventLogEntryType" />, use a different overload of <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>If the source specified in the <see cref="P:System.Diagnostics.EventLog.Source" /> property of this <see cref="T:System.Diagnostics.EventLog" /> instance is not registered on the computer that your component is writing to, <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> calls <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> and registers the source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> or <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, the local computer (".") is assumed.</para></block><para>If the system needs to register the <see cref="P:System.Diagnostics.EventLog.Source" /> through a call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> and the <see cref="P:System.Diagnostics.EventLog.Log" /> property has not been set on your <see cref="T:System.Diagnostics.EventLog" /> instance, the log defaults to the Application log.</para><block subset="none" type="note"><para>Many of the exceptions listed above are generated by errors raised during the process of registering the <see cref="P:System.Diagnostics.EventLog.Source" />.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.</para></block><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an information type entry, with the given message text, to the event log.</para></summary><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public void WriteEntry (string message, System.Diagnostics.EventLogEntryType type);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEntry(string message, valuetype System.Diagnostics.EventLogEntryType type) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry of a specified <see cref="T:System.Diagnostics.EventLogEntryType" /> to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>If the source specified in the <see cref="P:System.Diagnostics.EventLog.Source" /> property of this <see cref="T:System.Diagnostics.EventLog" /> instance is not registered on the computer that your component is writing to, <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> calls <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> and registers the source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> or <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, the local computer (".") is assumed.</para></block><para>If the system needs to register the <see cref="P:System.Diagnostics.EventLog.Source" /> through a call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> and the <see cref="P:System.Diagnostics.EventLog.Log" /> property has not been set on your <see cref="T:System.Diagnostics.EventLog" /> instance, the log defaults to the Application log.</para><block subset="none" type="note"><para>Many exceptions listed above are generated by errors raised during the process of registering the <see cref="P:System.Diagnostics.EventLog.Source" />.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.</para></block><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log.</para></summary><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public static void WriteEntry (string source, string message);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEntry(string source, string message) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="message" Type="System.String" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an information entry to the event log, using a source that is already registered as an event source for the appropriate log. If you want to specify any other <see cref="T:System.Diagnostics.EventLogEntryType" />, use a different overload of <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an information type entry with the given message text to the event log, using the specified registered event source.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public void WriteEntry (string message, System.Diagnostics.EventLogEntryType type, int eventID);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEntry(string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry with an application-defined <paramref name="eventID" /> to the event log. The <paramref name="eventID" /> together with the source uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>In addition to the event identifier, you can specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>If the source specified in the <see cref="P:System.Diagnostics.EventLog.Source" /> property of this <see cref="T:System.Diagnostics.EventLog" /> instance is not registered on the computer that your component is writing to, <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> calls <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> and registers the source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> or <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, the local computer (".") is assumed.</para></block><para>If the system needs to register the <see cref="P:System.Diagnostics.EventLog.Source" /> through a call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> and the <see cref="P:System.Diagnostics.EventLog.Log" /> property has not been set on your <see cref="T:System.Diagnostics.EventLog" /> instance, the log defaults to the Application log.</para><block subset="none" type="note"><para>Many exceptions listed above are generated by errors raised during the process of registering the <see cref="P:System.Diagnostics.EventLog.Source" />.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.</para></block><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text and application-defined event identifier to the event log.</para></summary><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public static void WriteEntry (string source, string message, System.Diagnostics.EventLogEntryType type);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEntry(string source, string message, valuetype System.Diagnostics.EventLogEntryType type) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry of a specified <see cref="T:System.Diagnostics.EventLogEntryType" /> to the event log, using a source already registered as an event source for the appropriate log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log, using the specified registered event source.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public void WriteEntry (string message, System.Diagnostics.EventLogEntryType type, int eventID, short category);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEntry(string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID, int16 category) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /><Parameter Name="category" Type="System.Int16" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry with an application-defined <paramref name="category" /> to the event log. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.</para><block subset="none" type="note"><para>The <paramref name="category" /> parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.</para></block><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the <paramref name="category" /> to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified <paramref name="category" /> does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the <see cref="T:System.Diagnostics.EventLogInstaller" /> or the <see cref="T:System.Diagnostics.EventSourceCreationData" /> class.</para><para>In addition to the category, you can specify an event identifier for the event being written to the event log. Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.</para><para>Finally, you can specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>If the source specified in the <see cref="P:System.Diagnostics.EventLog.Source" /> property of this <see cref="T:System.Diagnostics.EventLog" /> instance is not registered on the computer that your component is writing to, <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> calls <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> and registers the source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> or <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, the local computer (".") is assumed.</para></block><para>If the system needs to register the <see cref="P:System.Diagnostics.EventLog.Source" /> through a call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> and the <see cref="P:System.Diagnostics.EventLog.Log" /> property has not been set on your <see cref="T:System.Diagnostics.EventLog" /> instance, the log defaults to the Application log.</para><block subset="none" type="note"><para>Many exceptions listed above are generated by errors raised during the process of registering the <see cref="P:System.Diagnostics.EventLog.Source" />.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.</para></block><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log.</para></summary><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param><param name="category"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific subcategory associated with the message. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public static void WriteEntry (string source, string message, System.Diagnostics.EventLogEntryType type, int eventID);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEntry(string source, string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry with an application-defined <paramref name="eventID" /> to the event log, using a source already registered as an event source for the appropriate log. The <paramref name="eventID" />, along with the source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers present these strings to the user to help the user understand what went wrong and suggest what actions to take.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><para>In addition to the event identifier, this overload of <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> lets you specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text and application-defined event identifier to the event log, using the specified registered event source.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public void WriteEntry (string message, System.Diagnostics.EventLogEntryType type, int eventID, short category, byte[] rawData);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEntry(string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID, int16 category, unsigned int8[] rawData) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /><Parameter Name="category" Type="System.Int16" /><Parameter Name="rawData" Type="System.Byte[]" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this overload to write application-defined event-specific data to the event log. The Event Viewer does not interpret this data; it displays raw data only in a combined hexadecimal and text format. Use event-specific data sparingly, including it only if you are sure it will be useful to someone debugging the problem. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the logfile and creates reports that include information from the event-specific data.</para><para>In addition to the binary data, you can specify an application-defined category and an application-defined event identifier. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.</para><block subset="none" type="note"><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block><block subset="none" type="note"><para>The <paramref name="category" /> parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.</para></block><para>To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the <paramref name="category" /> to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified <paramref name="category" /> does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the <see cref="T:System.Diagnostics.EventLogInstaller" /> or the <see cref="T:System.Diagnostics.EventSourceCreationData" /> class.</para><para>Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.</para><para>Finally, you can specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.</para><para>Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>If the source specified in the <see cref="P:System.Diagnostics.EventLog.Source" /> property of this <see cref="T:System.Diagnostics.EventLog" /> instance is not registered on the computer that your component is writing to, <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> calls <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> and registers the source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> or <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" />, the local computer (".") is assumed.</para></block><para>If the system needs to register the <see cref="P:System.Diagnostics.EventLog.Source" /> through a call to <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> and the <see cref="P:System.Diagnostics.EventLog.Log" /> property has not been set on your <see cref="T:System.Diagnostics.EventLog" /> instance, the log defaults to the Application log.</para><block subset="none" type="note"><para>Many exceptions listed above are generated by errors raised during the process of registering the <see cref="P:System.Diagnostics.EventLog.Source" />.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.</para></block><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, and appends binary data to the message.</para></summary><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param><param name="category"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific subcategory associated with the message. </param><param name="rawData"><attribution license="cc4" from="Microsoft" modified="false" />An array of bytes that holds the binary data associated with the entry. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public static void WriteEntry (string source, string message, System.Diagnostics.EventLogEntryType type, int eventID, short category);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEntry(string source, string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID, int16 category) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /><Parameter Name="category" Type="System.Int16" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write an entry with an application-defined <paramref name="category" /> to the event log, using a source that is already registered as an event source for the appropriate log. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.</para><block subset="none" type="note"><para>The <paramref name="category" /> parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.</para></block><para>To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the <paramref name="category" /> to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified <paramref name="category" /> does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the <see cref="T:System.Diagnostics.EventLogInstaller" /> or the <see cref="T:System.Diagnostics.EventSourceCreationData" /> class.</para><para>In addition to the category, you can specify an event identifier for the event being written to the event log. Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.</para><para>Finally, you can specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, using the specified registered event source. The <paramref name="category" /> can be used by the Event Viewer to filter events in the log.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param><param name="category"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific subcategory associated with the message. </param></Docs></Member><Member MemberName="WriteEntry"><MemberSignature Language="C#" Value="public static void WriteEntry (string source, string message, System.Diagnostics.EventLogEntryType type, int eventID, short category, byte[] rawData);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEntry(string source, string message, valuetype System.Diagnostics.EventLogEntryType type, int32 eventID, int16 category, unsigned int8[] rawData) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>1.0.5000.0</AssemblyVersion><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="message" Type="System.String" /><Parameter Name="type" Type="System.Diagnostics.EventLogEntryType" /><Parameter Name="eventID" Type="System.Int32" /><Parameter Name="category" Type="System.Int16" /><Parameter Name="rawData" Type="System.Byte[]" /></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write application-defined event-specific data to the event log, using a source already registered as an event source for the appropriate log. The Event Viewer does not interpret this data; it displays raw data only in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the logfile and creates reports that include information from the event-specific data.</para><para>In addition to the binary data, you can specify an application-defined category and an application-defined event identifier. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.</para><block subset="none" type="note"><para>The <paramref name="category" /> parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 will appear as 65,526, a –1 as 65,535.</para></block><para>To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the <paramref name="category" /> to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified <paramref name="category" /> does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the <see cref="T:System.Diagnostics.EventLogInstaller" /> or the <see cref="T:System.Diagnostics.EventSourceCreationData" /> class.</para><para>Event identifiers, together with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.</para><para>Finally, you can specify an <see cref="T:System.Diagnostics.EventLogEntryType" /> for the event being written to the event log. The <paramref name="type" /> is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. The <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method writes the given string directly to the event log; it does not use a localizable message resource file. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write events using a localized message resource file.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If the <paramref name="message" /> parameter contains a NUL character, the message in the event log is terminated at the NUL character. </para><para>The <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log (using the specified registered event source) and appends binary data to the message.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The source by which the application is registered on the specified computer. </param><param name="message"><attribution license="cc4" from="Microsoft" modified="false" />The string to write to the event log. </param><param name="type"><attribution license="cc4" from="Microsoft" modified="false" />One of the <see cref="T:System.Diagnostics.EventLogEntryType" /> values. </param><param name="eventID"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific identifier for the event. </param><param name="category"><attribution license="cc4" from="Microsoft" modified="false" />The application-specific subcategory associated with the message. </param><param name="rawData"><attribution license="cc4" from="Microsoft" modified="false" />An array of bytes that holds the binary data associated with the entry. </param></Docs></Member><Member MemberName="WriteEvent"><MemberSignature Language="C#" Value="public void WriteEvent (System.Diagnostics.EventInstance instance, object[] values);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEvent(class System.Diagnostics.EventInstance instance, object[] values) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="instance" Type="System.Diagnostics.EventInstance" /><Parameter Name="values" Type="System.Object[]"><Attributes><Attribute><AttributeName>System.ParamArray</AttributeName></Attribute></Attributes></Parameter></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write a localized entry to the event log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the <see cref="P:System.Diagnostics.EventLog.Source" />. You must register the source with the corresponding resource file before you write events using resource identifiers.</para><para>The input <paramref name="instance" /> instance specifies the event message and properties. Set the <see cref="P:System.Diagnostics.EventInstance.InstanceId" /> of the <paramref name="instance" /> input for the defined message in the source message resource file. You can optionally set the <see cref="P:System.Diagnostics.EventInstance.CategoryId" /> and <see cref="P:System.Diagnostics.EventInstance.EntryType" /> of the <paramref name="instance" /> input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set <paramref name="values" /> to null if the event message does not contain formatting placeholders for replacement strings.</para><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before using <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" />. The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method if your application writes string values directly to the event log.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the <paramref name="message" /> string might not be what you expect if the remote computer is not running the .NET Framework. Also, the <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes a localized entry to the event log.</para></summary><param name="instance"><attribution license="cc4" from="Microsoft" modified="false" />An <see cref="T:System.Diagnostics.EventInstance" /> instance that represents a localized event log entry. </param><param name="values"><attribution license="cc4" from="Microsoft" modified="false" />An array of strings to merge into the message text of the event log entry. </param></Docs></Member><Member MemberName="WriteEvent"><MemberSignature Language="C#" Value="public void WriteEvent (System.Diagnostics.EventInstance instance, byte[] data, object[] values);" /><MemberSignature Language="ILAsm" Value=".method public hidebysig instance void WriteEvent(class System.Diagnostics.EventInstance instance, unsigned int8[] data, object[] values) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><Attributes><Attribute><AttributeName>System.Runtime.InteropServices.ComVisible(false)</AttributeName></Attribute></Attributes><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="instance" Type="System.Diagnostics.EventInstance" /><Parameter Name="data" Type="System.Byte[]" /><Parameter Name="values" Type="System.Object[]"><Attributes><Attribute><AttributeName>System.ParamArray</AttributeName></Attribute></Attributes></Parameter></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write a localized entry with additional event-specific data to the event log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the <see cref="P:System.Diagnostics.EventLog.Source" />. You must register the source with the corresponding resource file before you write events using resource identifiers.</para><para>The input <paramref name="instance" /> instance specifies the event message and properties. Set the <see cref="P:System.Diagnostics.EventInstance.InstanceId" /> of the <paramref name="instance" /> input for the defined message in the source message resource file. You can optionally set the <see cref="P:System.Diagnostics.EventInstance.CategoryId" /> and <see cref="P:System.Diagnostics.EventInstance.EntryType" /> of the <paramref name="instance" /> input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set <paramref name="values" /> to null if the event message does not contain formatting placeholders for replacement strings.</para><para>Specify binary data with an event when it is necessary to provide additional details for the event. For example, use the <paramref name="data" /> parameter to include information on a specific error. The Event Viewer does not interpret the associated event data; it displays the data in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the event log and creates reports that include information from the event-specific data.</para><para>You must set the <see cref="P:System.Diagnostics.EventLog.Source" /> property on your <see cref="T:System.Diagnostics.EventLog" /> component before component before using <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" />. The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><block subset="none" type="note"><para>If you do not specify a <see cref="P:System.Diagnostics.EventLog.MachineName" /> for your <see cref="T:System.Diagnostics.EventLog" /> instance before you call <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" />, the local computer (".") is assumed.</para></block><para>The source must be configured either for writing localized entries or for writing direct strings. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method if your application writes string values directly to the event log.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para><block subset="none" type="note"><para>If you write an entry to a remote computer, the value of the <paramref name="message" /> string might not be what you expect if the remote computer is not running the .NET Framework. Also, the <paramref name="message" /> string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.</para></block></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an event log entry with the given event data, message replacement strings, and associated binary data.</para></summary><param name="instance"><attribution license="cc4" from="Microsoft" modified="false" />An <see cref="T:System.Diagnostics.EventInstance" /> instance that represents a localized event log entry. </param><param name="data"><attribution license="cc4" from="Microsoft" modified="false" />An array of bytes that holds the binary data associated with the entry. </param><param name="values"><attribution license="cc4" from="Microsoft" modified="false" />An array of strings to merge into the message text of the event log entry. </param></Docs></Member><Member MemberName="WriteEvent"><MemberSignature Language="C#" Value="public static void WriteEvent (string source, System.Diagnostics.EventInstance instance, object[] values);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEvent(string source, class System.Diagnostics.EventInstance instance, object[] values) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="instance" Type="System.Diagnostics.EventInstance" /><Parameter Name="values" Type="System.Object[]"><Attributes><Attribute><AttributeName>System.ParamArray</AttributeName></Attribute></Attributes></Parameter></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write a localized entry to the event log, using a source already registered as an event source for the appropriate log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the source. You must register the source with the corresponding resource file before you write events using resource identifiers.</para><para>The input <paramref name="instance" /> instance specifies the event message and properties. Set the <see cref="P:System.Diagnostics.EventInstance.InstanceId" /> of the <paramref name="instance" /> input for the defined message in the source message resource file. You can optionally set the <see cref="P:System.Diagnostics.EventInstance.CategoryId" /> and <see cref="P:System.Diagnostics.EventInstance.EntryType" /> of the <paramref name="instance" /> input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set <paramref name="values" /> to null if the event message does not contain formatting placeholders for replacement strings.</para><para>The specified source must be registered for an event log before using <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" />. The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method if your application writes string values directly to the event log.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an event log entry with the given event data and message replacement strings, using the specified registered event source.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name of the event source registered for the application on the specified computer. </param><param name="instance"><attribution license="cc4" from="Microsoft" modified="false" />An <see cref="T:System.Diagnostics.EventInstance" /> instance that represents a localized event log entry. </param><param name="values"><attribution license="cc4" from="Microsoft" modified="false" />An array of strings to merge into the message text of the event log entry. </param></Docs></Member><Member MemberName="WriteEvent"><MemberSignature Language="C#" Value="public static void WriteEvent (string source, System.Diagnostics.EventInstance instance, byte[] data, object[] values);" /><MemberSignature Language="ILAsm" Value=".method public static hidebysig void WriteEvent(string source, class System.Diagnostics.EventInstance instance, unsigned int8[] data, object[] values) cil managed" /><MemberType>Method</MemberType><AssemblyInfo><AssemblyVersion>2.0.0.0</AssemblyVersion><AssemblyVersion>4.0.0.0</AssemblyVersion></AssemblyInfo><ReturnValue><ReturnType>System.Void</ReturnType></ReturnValue><Parameters><Parameter Name="source" Type="System.String" /><Parameter Name="instance" Type="System.Diagnostics.EventInstance" /><Parameter Name="data" Type="System.Byte[]" /><Parameter Name="values" Type="System.Object[]"><Attributes><Attribute><AttributeName>System.ParamArray</AttributeName></Attribute></Attributes></Parameter></Parameters><Docs><remarks><attribution license="cc4" from="Microsoft" modified="false" /><para>Use this method to write a localized entry with additional event-specific data to the event log, using a source already registered as an event source for the appropriate log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the source. You must register the source with the corresponding resource file before you write events using resource identifiers.</para><para>The input <paramref name="instance" /> instance specifies the event message and properties. Set the <see cref="P:System.Diagnostics.EventInstance.InstanceId" /> of the <paramref name="instance" /> input for the defined message in the source message resource file. You can optionally set the <see cref="P:System.Diagnostics.EventInstance.CategoryId" /> and <see cref="P:System.Diagnostics.EventInstance.EntryType" /> of the <paramref name="instance" /> input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set <paramref name="values" /> to null if the event message does not contain formatting placeholders for replacement strings.</para><para>Specify binary data with an event when it is necessary to provide additional details for the event. For example, use the <paramref name="data" /> parameter to include information on a specific error. The Event Viewer does not interpret the associated event data; it displays the data in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the event log and creates reports that include information from the event-specific data.</para><para>The specified source must be registered for an event log before using <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" />. The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.</para><para>You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an <see cref="T:System.Diagnostics.EventLogInstaller" />, or using the <see cref="Overload:System.Diagnostics.EventLog.CreateEventSource" /> method. You must have administrative rights on the computer to create a new event source.</para><para>The source must be configured either for writing localized entries or for writing direct strings. Use the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method if your application writes string values directly to the event log.</para><para>If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEvent" /> method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the <see cref="Overload:System.Diagnostics.EventLog.WriteEntry" /> method to write strings directly to the event log using that source.</para></remarks><summary><attribution license="cc4" from="Microsoft" modified="false" /><para>Writes an event log entry with the given event data, message replacement strings, and associated binary data, and using the specified registered event source.</para></summary><param name="source"><attribution license="cc4" from="Microsoft" modified="false" />The name of the event source registered for the application on the specified computer. </param><param name="instance"><attribution license="cc4" from="Microsoft" modified="false" />An <see cref="T:System.Diagnostics.EventInstance" /> instance that represents a localized event log entry. </param><param name="data"><attribution license="cc4" from="Microsoft" modified="false" />An array of bytes that holds the binary data associated with the entry. </param><param name="values"><attribution license="cc4" from="Microsoft" modified="false" />An array of strings to merge into the message text of the event log entry. </param></Docs></Member></Members></Type>