EventLog config in AppSettings

[gatecrasher63]

I want to configure the Sink in Config

"Serilog": {
    "MinimumLevel": {
      "Default": "Debug", //Fatal, Error, Warning, Information, Debug, Verbose. 
      "Override": {
        "System": "Information",
        "Microsoft": "Information",
        "Microsoft.AspNetCore.Authentication": "Information"
      }
    },
    "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.EventLog" ], 
    "WriteTo": [
      {
        "Name": "Console",
        "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff} [{Level:u3}] {CorrelationId} {LogName} : {Message:lj}{NewLine}{Exception}"
      },
      {
        "Name": "EventLog",
        "Args": {
          "source": "ABC10",
          "logName": "Application",
          "restrictedToMinimumLevel": "Error"
        }
      }
    ],
    "Enrich": [ "FromLogContext", "WithCorrelationId" ]
  }_

but it fails. Whereas

_Log.Logger = new LoggerConfiguration()
	.ReadFrom.Configuration(Configuration)
            .Enrich.WithProperty("AppName", "FES10")
            .Enrich.WithProperty("AppVersion", Configuration.GetValue<string>("Version"))
            .Destructure.UsingAttributes()
            .Destructure.ToMaximumDepth(6)
            .WriteTo.EventLog("ABC10", "Application", manageEventSource: false, restrictedToMinimumLevel: LogEventLevel.Error)
            .CreateLogger();_

works, sort of. I do get an odd event written however

The description for Event ID 59550 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Message Content here


The message resource is present but the message was not found in the message table

[e2ibrobbins]

I am also struggling to configure this sink from configuration file. I have created a custom event source. I can write to it by using

Log.Logger = new LoggerConfiguration().ReadFrom.Configuration(config).WriteTo.EventLog("{my custom source}", manageEventSource: true).CreateLogger();

but I am not able to write to the source using configuration.

Can someone give a suggested configuration file that will work?

[henkla]

Any update on this? I have the same issue:

• No events are showing up in the system event log when configuring the sink using appsettings.json

Does NOT work

From Program.cs:

Log.Logger = new LoggerConfiguration()
    .ReadFrom.Configuration(configuration)
    .CreateLogger();

From appsettings.json:

...
"WriteTo": [
    {
        "Name": "EventLog",
        "Args": {
          "source": "ApplicationName",
          "restrictedToMinimumLevel": "Information",
          "manageEventSource": true
        }
      }
]

DOES work

From Program.cs:

Log.Logger = new LoggerConfiguration()
    .WriteTo.EventLog(source: "ApplicationName",
                      manageEventSource: true,
                      restrictedToMinimumLevel: LogEventLevel.Information)
    .CreateLogger();

Setup

• .NET 5
• Serilog.Sinks.EventLog (3.1.0)

Also

• All my other sinks are working while configured using appsettings.json

[kaffeebrauer]

What does work is after removing the JSON block specifying the using section

 "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.EventLog" ], 

From appsettings.json

 "Serilog": {
    "MinimumLevel": {
      "Default": "Debug",
      "Override": {
        "Microsoft": "Warning",
        "System": "Warning"
      }
    },
    "WriteTo": [
      {
        "Name": "Async",
        "Args": {
          "configure": [
            {
              "Name": "Console"
            },
            {
              "Name": "File",
              "Args": {
                "path": "xyz.log",
                "rollingInterval": "Day",
                "retainedFileCountLimit": 7,
                "buffered": true,
                "flushToDiskInterval": "00:00:02"
              }
            },
            {
              "Name": "EventLog",
              "Args": {
                "source": "Namespace.Service.XyzService",
                "logName": "Namespace.Service.XyzService",
                "restrictedToMinimumLevel": "Warning"
              }
            }

          ]
        }
      }
    ],
    "Enrich": [ "FromLogContext", "WithMachineName" ],
    "Properties": {
      "Application": "Namespace.Service.XyzService",
      "Environment": "Development"
    }
  }

From Program.cs

        public static IHostBuilder CreateHostBuilder(string[] args)
        {
            var host = Host.CreateDefaultBuilder(args)
                .UseSerilog((context, configuration) => configuration.ReadFrom.Configuration(context.Configuration))
                ...

Setup

• .NET 5
• Serilog.Sinks.EventLog (3.1.0)

Once it has executed, reopen Windows Event Viewer, as the source folder does not appear immediately.

[suttoa5]

Has anything more been found on this? I too can only configure eventlog from the program.cs instead of through the appsettings like the rest. I have tried both with and without the using[] in the appsettings.

[IrvingRosslet]

Looks like you need to set the "manageEventSource" arg to true in order for appSettings to work from scratch, I assume otherwise the logged events cannot be added as the source doesn't exist.

  {
    "Name": "EventLog",
    "Args": {
      "source": "sourceName",
      "logName": "logName",
      "manageEventSource": true, // Important!
      "restrictedToMinimumLevel": "Fatal"
    }
  }

[majidsd]

Looks like you need to set the "manageEventSource" arg to true in order for appSettings to work from scratch, I assume otherwise the logged events cannot be added as the source doesn't exist.

  {
    "Name": "EventLog",
    "Args": {
      "source": "sourceName",
      "logName": "logName",
      "manageEventSource": true, // Important!
      "restrictedToMinimumLevel": "Fatal"
    }
  }

From the main page Serilog EventLog there is this:

Important: version 3.0 of this sink changed the default value of manageEventSource from true to false. Applications that run with administrative priviliges, and that can therefore create event sources on-the-fly, can opt-in by providing manageEventSource: true as a configuration option.