C# 未找到来源，但无法搜索部分或全部事件日志

The source was not found, but some or all event logs could not be searched

提问by Vaibhav Jain

I am getting the following exception. I have given full control to Asp.net account on Eventlogs in Registry edit.

我收到以下异常。我已经完全控制了注册表编辑中事件日志的 Asp.net 帐户。

[SecurityException: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.]

System.Diagnostics.EventLog.FindSourceRegistration(String source,  String machineName, Boolean readOnly, Boolean wantToCreate) +664
System.Diagnostics.EventLog.SourceExists(String source, String machineName, Boolean wantToCreate) +109
System.Diagnostics.EventLog.SourceExists(String source) +14 Microsoft.ApplicationBlocks.ExceptionManagement.DefaultPublisher.VerifyValidSource() +41

[SecurityException：未找到源，但无法搜索部分或全部事件日志。无法访问的日志：安全性。]

System.Diagnostics.EventLog.FindSourceRegistration(String source,  String machineName, Boolean readOnly, Boolean wantToCreate) +664
System.Diagnostics.EventLog.SourceExists(String source, String machineName, Boolean wantToCreate) +109
System.Diagnostics.EventLog.SourceExists(String source) +14 Microsoft.ApplicationBlocks.ExceptionManagement.DefaultPublisher.VerifyValidSource() +41

I guess this is due to some configuration issue on server?

我猜这是由于服务器上的一些配置问题？

采纳答案by Nicole Calinoiu

EventLog.SourceExistsenumerates through the subkeys of HKLM\SYSTEM\CurrentControlSet\services\eventlogto see if it contains a subkey with the specified name. If the user account under which the code is running does not have read access to a subkey that it attempts to access (in your case, the Securitysubkey) before finding the target source, you will see an exception like the one you have described.

EventLog.SourceExists枚举 的子项HKLM\SYSTEM\CurrentControlSet\services\eventlog以查看它是否包含具有指定名称的子项。如果Security在查找目标源之前运行代码的用户帐户没有对它尝试访问的子项（在您的情况下为子项）的读取访问权限，您将看到类似于您描述的异常。

The usual approach for handling such issues is to register event log sourcesat installation time (under an administrator account), then assume that they exist at runtime, allowing any resulting exception to be treated as unexpected if a target event log source does not actually exist at runtime.

处理此类问题的常用方法是在安装时（在管理员帐户下）注册事件日志源，然后假设它们在运行时存在，如果目标事件日志源实际上不存在，则允许将任何产生的异常视为意外在运行时。

回答by dmolisher

Launch Developer command line "As an Administrator". This account has full access to Security log

启动开发人员命令行“作为管理员”。此帐户对安全日志具有完全访问权限

回答by live-love

Had the same exception. In my case, I had to run Command Prompt with Administrator Rights.

有同样的例外。就我而言，我必须以管理员权限运行命令提示符。

From the Start Menu, right click on Command Prompt, select "Run as administrator".

在开始菜单中，右键单击命令提示符，选择“以管理员身份运行”。

回答by Raza

For me this error was due to the command prompt, which was not running under administrator privileges. You need to right click on the command prompt and say "Run as administrator".

对我来说，这个错误是由于命令提示符导致的，它不是在管理员权限下运行的。您需要右键单击命令提示符并说“以管理员身份运行”。

You need administrator role to install or uninstall a service.

您需要管理员角色来安装或卸载服务。

回答by Mike Hart

Didnt work for me.

没有为我工作。

I created a new key and string value and managed to get it working

我创建了一个新的键和字符串值并设法让它工作

Key= HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\<Your app name>\
String EventMessageFile value=C:\Windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

回答by Miroslav Bihari

For me just worked iisreset (run cmd as administrator -> iisreset). Maybe somebody could give it a try.

对我来说刚刚工作 iisreset （以管理员身份运行 cmd -> iisreset）。也许有人可以尝试一下。

回答by Thane Plummer

If you are performing a new install of the SenseNet TaskManagement website on IIS (from source code, not WebPI), you will get this message, usually related to SignalR communication. As @nicole-caliniou points out,it is due to a key search in the Registry that fails.

如果您在 IIS 上执行 SenseNet TaskManagement 网站的新安装（来自源代码，而不是 WebPI），您将收到此消息，通常与 SignalR 通信有关。正如@nicole-caliniou 指出的那样，这是由于注册表中的键搜索失败。

To solve this for SenseNet TaskManagement v1.1.0, first find the registry key name in the web.config file. By default it is "SnTaskWeb".

要为 SenseNet TaskManagement v1.1.0 解决此问题，请首先在 web.config 文件中找到注册表项名称。默认情况下它是“SnTaskWeb”。

 <appSettings>
   <add key="LogSourceName" value="SnTaskWeb" />

Open the registry editor, regedit.exe, and navigate to HKLM\SYSTEM\CurrentControlSet\Services\EventLog\SnTask. Right-click on SnTask and select New Key, and name the key SnTaskWebfor the configuration shown above. Then right-click on the SnTaskWebelement and select New Expandable String Value. The name should be EventMessageFileand the value data should be C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll.

打开注册表编辑器regedit.exe，然后导航到HKLM\SYSTEM\CurrentControlSet\Services\EventLog\SnTask。右键单击 SnTask 并选择New Key，然后SnTaskWeb为上面显示的配置命名键。然后右键单击该SnTaskWeb元素并选择New Expandable String Value。名称应为EventMessageFile，值数据应为C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll。

Keywords: signalr, sensenet, regedit, permissions

关键词：signalr、sensenet、regedit、权限

回答by Bizhan

Inaccessible logs: Security

无法访问的日志：安全

A new event source needs to have a unique nameacross all logs including Security(which needs admin privilege when it's being read).

新的事件源需要在包括安全性在内的所有日志中具有唯一的名称（读取时需要管理员权限）。

So your app will need admin privilegeto create a source. But that's probably an overkill.

因此，您的应用需要管理员权限才能创建源。但这可能是一种矫枉过正。

I wrote this powershell scriptto create the event source at will. Save it as *.ps1and run it with anyprivilege and it will elevate itself.

我写了这个powershell 脚本来随意创建事件源。将它另存为*.ps1并以任何权限运行它，它会提升自己。

# CHECK OR RUN AS ADMIN

If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{   
    $arguments = "& '" + $myinvocation.mycommand.definition + "'"
    Start-Process powershell -Verb runAs -ArgumentList $arguments
    Break
}

# CHECK FOR EXISTENCE OR CREATE

$source = "My Service Event Source";
$logname = "Application";

if ([System.Diagnostics.EventLog]::SourceExists($source) -eq $false) {
    [System.Diagnostics.EventLog]::CreateEventSource($source, $logname);
    Write-Host $source -f white -nonewline; Write-Host " successfully added." -f green;
}
else
{
    Write-Host $source -f white -nonewline; Write-Host " already exists.";
}

# DONE

Write-Host -NoNewLine 'Press any key to continue...';
$null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown');

回答by Mandi

I recently experienced the error, and none of the solutions worked for me. What resolved the error for me was adding the Application pool user to the Power Users group in computer management. I couldn't use the Administrator group due to a company policy.

我最近遇到了这个错误，没有一个解决方案对我有用。为我解决错误的是将应用程序池用户添加到计算机管理中的 Power Users 组。由于公司政策，我无法使用管理员组。