如何使用System.Diagnostics中的EventLog类来访问本机的安全日志？

[chinapro]

Sub bind()
Try
aLog = New EventLog()
aLog.Log = logtype.SelectedItem.Value
aLog.MachineName = "."
dt = New DataTable()
dt.Columns.Add(New DataColumn("imagestr", GetType(String)))
dt.Columns.Add(New DataColumn("TimeGenerated", GetType(Date)))
dt.Columns.Add(New DataColumn("Source", GetType(String)))
dt.Columns.Add(New DataColumn("EventID", GetType(Integer)))
dt.Columns.Add(New DataColumn("entrytype", GetType(Integer)))
dt.Columns.Add(New DataColumn("eventmess", GetType(String)))
'///////////////////////////////////////////////////
'//当aLog.Log="Security",执行到下面的语句时出错!!!
'//ex.message为:Cannot open log Security on machine .. Windows has not provided an error code.
'//是否需要对ASPNet用户的权限进行一些特殊的设置？？？
'///////////////////////////////////////////////////
For Each entry In aLog.Entries
Select Case (entry.EntryType)
Case EventLogEntryType.Warning
strImage = "warning.png"
Case EventLogEntryType.Error
strImage = "error.png"
Case EventLogEntryType.Information
strImage = "info.png"
End Select
If entry.EntryType = eventtype.SelectedItem.Value Then
Select Case sj.SelectedItem.Value
Case "1"
If entry.TimeGenerated >= Date.Today Then
addrow()
End If
Case "2"
If entry.TimeGenerated > Date.Today.AddDays(-1) And entry.TimeGenerated <= Date.Today Then
addrow()
End If
Case "3"
If entry.TimeGenerated > Date.Today.AddDays(-7) Then
addrow()
End If
Case "4"
If entry.TimeGenerated.Year = Date.Today.Year And entry.TimeGenerated.Month = Date.Today.Month Then
addrow()
End If
End Select
End If
Next entry
dv = New DataView(dt)
If dv.Count > 0 Then
DataGrid1.DataSource = dv
Else
errmess.Text = "<div align='center'>尚无记录！</div>"
DataGrid1.DataSource = Nothing
End If
DataGrid1.DataBind()
Catch ex As Exception
Me.errmess.Text = ex.Message
DataGrid1.DataSource = Nothing
DataGrid1.DataBind()
Finally

End Try
End Sub

[Jouzen]

参看以下回答:
private void LogEvent(string message)
{
if (!EventLog.SourceExists("YnaBooking"))
{
EventLog.CreateEventSource("YnaBooking", "Application");
}
EventLog.WriteEntry("YnaBooking", message, EventLogEntryType.Error);
}

但需要写入日志的权限~
可以通过修改Machine.Config 的 <processModel> 把userName 属性改为SYSTEM

微软专家回答：

根据我的经验，导致该问题的原因在于ASP.NET工作进程的Identity (默认情况下是ASPNET)没有修改注册表的权限。

当您使用CreateEventSource函数时，会进行写注册表操作。

建议您参阅下面的方法解决该问题：

如果您使用Windows XP:

1. Click "Start->Run".

2. Enter "RegEdit"

3. 右键点击：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog，选择Permissions. 给 "ASPNET" 赋予合适的权限。（如果您在ASP.NET中impersonate到其他的用户， 请合适的替换ASPNET)

4. 右键点击HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security,选择Permissions. 给 "ASPNET" 赋予至少Read的权限。（如果您在ASP.NET中impersonate到其他的用户， 请合适的替换ASPNET)

如果是Windows 2000:

1。 Click "Start->Run".

2. Enter "regedt32"

3. Click "Security->Permission" on the menu bar.

4. 给 "ASPNET" 赋予在下面键值上合适的权限。（如果您在ASP.NET中impersonate到其他的用户， 请合适的替换ASPNET)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

[chinapro]

up!