Troubleshooting CreateEvtLog Errors: Common Causes & Fixes
Overview
CreateEvtLog errors typically occur when creating or registering an event source/log on Windows (API: CreateEventLog/RegisterEventSource or tools/libraries wrapping them). Causes usually involve permissions, incorrect parameters, missing registry keys, or environment issues. Below are common causes and concrete fixes.
Common Causes and Fixes
- Insufficient permissions
- Cause: Creating an event source modifies the registry under HKLM\System\CurrentControlSet\Services\EventLog — requires admin rights.
- Fix: Run the installer or script as an administrator (elevated PowerShell/CMD). For services, perform registration in an elevated setup step. When possible, create event sources during installation rather than at runtime.
- Event source already exists with different configuration
- Cause: A source with the same name exists but is associated with a different log name or has mismatched DLL/message file settings.
- Fix: Inspect registry at HKLM\SYSTEM\CurrentControlSet\Services\EventLog\. If incorrect, delete the source entry (careful) or use a unique source name. Recreate with the correct log mapping and message file configuration.
- Incorrect parameters or API usage
- Cause: Passing invalid strings (null/empty), wrong log names, or incorrect flags to CreateEventLog/RegisterEventSource.
- Fix: Validate inputs before calling the API. Use documented maximum name lengths and ensure log name is an allowed value. Use the appropriate API for the platform (.NET’s EventLog.CreateEventSource or Win32 CreateEventSource equivalents).
- Missing or incorrect message DLLs or EventManifest
- Cause: Event consumers expect message files or an event manifest; if missing or incorrectly referenced in the registry, logged events may show numeric codes instead of messages or fail.
- Fix: Deploy and register the proper message DLLs or centralized manifest. Update the registry entries (EventMessageFile, TypesSupported) to point to correct paths. For manifest-based providers, ensure manifests are registered with wevtutil.
- File system or registry access issues (UAC, group policy, antivirus)
- Cause: UAC prompts blocked, group policies prevent registry writes, or security software blocks modifications.
- Fix: Check group policy settings, temporarily disable interfering antivirus during setup, and ensure process has SE_RESTORE_NAME / SE_BACKUPNAME if required. Use event viewer/Process Monitor to trace failures.
- Running under restricted accounts (services, IIS, AppPool)
- Cause: Service or application pool identity lacks rights to create registry keys or access message DLLs.
- Fix: Perform registration during install under an admin account. Grant read access to the message DLLs and registry keys to the service/AppPool identity.
- Corrupted or locked registry keys
- Cause: Partial writes or corruption prevent creation.
- Fix: Repair registry permissions using regedit or subinacl, restore from backup, or remove stale keys if safe. Reboot may release locks.
- Platform or version differences
- Cause: API behavior differs between Windows versions (.NET Core/.NET Framework differences) or 32-bit vs 64-bit registry redirection.
- Fix: On 64-bit Windows, ensure 32-bit processes write to the correct registry hive (use Wow6432Node awareness or use 64-bit installer). For .NET Core, use the supported APIs or run a platform-specific installer step.
Diagnostic Steps (quick checklist)
- Reproduce the error and note the exact error code/message.
- Run the process elevated and retry.
- Check Event Viewer for related errors.
- Inspect registry: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\.
- Verify message DLL paths and manifest registration (wevtutil gp /m).
- Use Process Monitor to trace ACCESS DENIED or PATH NOT FOUND.
- Test creating a simple source with a different name to isolate conflicts.
Example fixes (commands)
- Create source in PowerShell (elevated):
Code
New-EventLog -LogName “Application” -Source “MyAppSource”
- Remove a bad source (registry or PowerShell):
Code
Remove-EventLog -Source “MyAppSource”
- Register manifest/DLL with wevtutil:
Code
wevtutil im MyApp.man wevtutil um MyApp.man
When to escalate
- If errors persist after elevation and verifying registry/paths, collect Process Monitor traces, exact error codes, and registry snapshots; escalate to system admin or Microsoft support.
Quick reference table
| Problem symptom | Likely cause | Immediate fix |
|---|---|---|
| ACCESS DENIED creating source | Permissions/UAC | Run elevated; install-time registration |
| Numeric event IDs / no message text | Missing message DLL/manifest | Register DLL/manifest; update EventMessageFile |
| Source exists but wrong log | Registry mapping mismatch | Delete/recreate source with correct log |
| 32-bit process can’t find key | Registry redirection | Use 64-bit installer or Wow6432Node-aware path |
If you want, I can produce a step-by-step elevated PowerShell script to detect and fix common CreateEvtLog issues for your environment — tell me the OS and whether you need 32-bit/64-bit support.
Leave a Reply