We have written a class responsible for logging events derived from EventSource of the .NET Framework 4.6. We have used this mechanism successfully in a web application but we are struggling to get it to work with a Windows application which is run as a service. The service is installed using the Installer Class. After installation, it is displayed in the services.msc snap-in, assigned to the local system account.
To register our EventSource we use the wevtutil program with the im Manifestfilename.man parameter. Opening the eventvwr.msc snap-in shows our newly registered EventSource. We are using the Debug and Operational channels to log our events.
However when we start the application by issuing the start command in the services snap-in, the logging mechanism does not seem to work correctly. The application does not produce any entries in the operational channel whatsoever. Instead it creates entries in the debug channel, but the entries it creates in the debug channel are entries that should have been written to the operational channel. The entries that were specified for the debug channel are ignored.
We have built in a debug mode mode into our application so we can run it as a desktop application without the need to install a service. When running the application in this debug mode, the event logging mechanism works flawlessly.
Therefore we suspect it is a permission issue, blocking our windows service from writing to the eventlog. It seems strange though, because the user executing the debug mode application is not as privileged as the local system account running the service. We have found no solution to this problem yet. Setting the permissions with wevtutil sl as described in this article did not yield the desired results.