Failed test: System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource

[JulieLeeMSFT]

Failed in: runtime-coreclr libraries-pgo/20250824.1

Failed tests:

net10.0-windows-Release-x86-jitosr_stress-Windows.10.Amd64.Open
- System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource
- System.Diagnostics.Tests.EventLogWriteEntryTests.WriteEventMessageValues_OutOfRange

Error message:

Starting:    System.Diagnostics.EventLog.Tests (parallel test collections = on [4 threads], stop on fail = off)
    System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource [FAIL]
      System.UnauthorizedAccessException : Attempted to perform an unauthorized operation.
      Stack Trace:
        /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/Win32.cs(308,0): at System.Security.AccessControl.Win32.SetSecurityInfo(ResourceType type, String name, SafeHandle handle, SecurityInfos securityInformation, SecurityIdentifier owner, SecurityIdentifier group, GenericAcl sacl, GenericAcl dacl)
        /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/NativeObjectSecurity.cs(263,0): at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
        /_/src/libraries/Common/src/System/Diagnostics/NetFrameworkUtils.cs(32,0): at System.Diagnostics.NetFrameworkUtils.EnterMutexWithoutGlobal(String mutexName, Mutex& mutex)
        /_/src/libraries/Common/src/System/Diagnostics/NetFrameworkUtils.cs(19,0): at System.Diagnostics.NetFrameworkUtils.EnterMutex(String name, Mutex& mutex)
        /_/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/EventLog.cs(446,0): at System.Diagnostics.EventLog.DeleteEventSource(String source, String machineName)
        /_/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/EventLog.cs(433,0): at System.Diagnostics.EventLog.DeleteEventSource(String source)
        /_/src/libraries/System.Diagnostics.EventLog/tests/EventLogTests/EventLogWriteEntryTests.cs(392,0): at System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource()
        /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
        /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
    System.Diagnostics.Tests.EventLogWriteEntryTests.WriteEventMessageValues_OutOfRange [FAIL]
      System.AggregateException : One or more errors occurred. (Assert.Throws() Failure: Exception type was not an exact match
      Expected: typeof(System.ArgumentException)
      Actual:   typeof(System.UnauthorizedAccessException)) (Assert.Throws() Failure: Exception type was not an exact match
    ...
    Stack Trace:
        /_/src/libraries/Common/tests/TestUtilities/System/RetryHelper.cs(54,0): at System.RetryHelper.Execute(Action test, Int32 maxAttempts, Func`2 backoffFunc, Predicate`1 retryWhen, String testName)
        /_/src/libraries/System.Diagnostics.EventLog/tests/Helpers.cs(40,0): at System.Diagnostics.Tests.Helpers.Retry[T](Func`1 func)
        /_/src/libraries/System.Diagnostics.EventLog/tests/EventLogTests/EventLogWriteEntryTests.cs(378,0): at System.Diagnostics.Tests.EventLogWriteEntryTests.WriteEventMessageValues_OutOfRange()
           at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
           at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
        /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
        /_/src/libraries/System.Private.CoreLib/src/System/Reflection/RuntimeMethodInfo.cs(126,0): at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
        ----- Inner Stack Trace #1 (Xunit.Sdk.ThrowsException) -----
        /_/src/libraries/System.Diagnostics.EventLog/tests/EventLogTests/EventLogWriteEntryTests.cs(378,0): at System.Diagnostics.Tests.EventLogWriteEntryTests.<>c__DisplayClass19_0.<WriteEventMessageValues_OutOfRange>b__0()
        /_/src/libraries/System.Diagnostics.EventLog/tests/Helpers.cs(42,0): at System.Diagnostics.Tests.Helpers.<>c__DisplayClass10_0`1.<Retry>b__0()
        /_/src/libraries/Common/tests/TestUtilities/System/RetryHelper.cs(45,0): at System.RetryHelper.Execute(Action test, Int32 maxAttempts, Func`2 backoffFunc, Predicate`1 retryWhen, String testName)

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-diagnostics-eventlog
See info in area-owners.md if you want to be subscribed.

[AndyAyersMS]

Similar to #116014.

@tommcdon @noahfalk any ideas on what this could be? It seems to be x86 only.

[noahfalk]

Not sure offhand. This is an old wrapper for the win32 EventLog API that @jeffhandley's team owns. The test is marked as only running elevated but I assume something is still out of sync between the permissions it has and the permissions it needs to call the API successfully.

@dotnet/area-system-diagnostics-eventlog - can you take a look at this?