Windows EventLog - Event ID 0

Question

I have a windows service app that uses the EventLog for logging. In the app installer I run:

eventcreate /L APPLICATION /SO "My App" /T SUCCESS /id 1 /D "Initialised Log"

Then in my application logger in C# I do:

EventLog.WriteEntry(message, EventLogEntryType.Error, 1, 0, details);

However when I look in the Application EventLog, in addition to my events I see entries with EventID 0. I cannot use eventcreate to create an ID=0 entry (says ID must be >=1). So what is creating these events? and is there any way to stop eventlog from complaining about corrupted installations?

One example entry says:

The following information was included with the event:

Service started successfully.

the message resource is present but the message is not found in the string/message table

Solution 1

The ServiceBase class has a property AutoLog, which by default is true. This means that it will automatically report state changes like Start, Stop, Pause and Continue. MSDN documentation is here.

If you want to report information to a custom log, rather than the Application log, or if you want to suppress these event log entries, you should set AutoLog to false in your constructor.

Solution 2

Are you getting the text:

The description for Event ID 0 from source myApp cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

In front of all the event log entries, follow by the proper error?

I had that after using eventcreate and could only get rid by editing the registry

HKLM\System\CurrentControlSet\Services\Eventlog\Application\MyEventSource

customSource (1)
EventMessageFile %SystemRoot%\System32\EventCreate.exe
TypesSupported (7)

I changed this to

EventMessageFile C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

and then all my eventlog entries (even old ones) looked right without complaining of corruption