BUG: Behavior of EventLog.Delete is Not Consistent with EventLog.Exists for Log Names Longer than 8 Characters (327890)

The information in this article applies to:

Microsoft .NET Framework Class Libraries 1.0
Microsoft .NET Framework Class Libraries 1.1

This article was previously published under Q327890

SYMPTOMS

The behavior of the EventLog.Delete() method is not consistent with the behavior of the EventLog.Exists() method for log names that are longer than 8 characters.

CAUSE

The EventLog.Exists() method uses only the first 8 characters of the passed string to determine whether a log exists. The EventLog.Delete() method uses all of the passed string to identify the log to be deleted. This causes an inconsistency between the two methods.

For example, a user may want to verify whether a log exists and then delete it, as shown in the following code:

if (EventLog.Exists("MyProgramLog1"))
{
    EventLog.Delete("MyProgramLog1");
}

The problem is that EventLog.Exists returns TRUE if any log beginning with MyProgra (8 characters) exists. An example scenario occurs as follows:

MyProgramLog2 (longer than 8 characters) exists.
MyProgramLog1 does not exist.
When EventLog.Delete is called, it determines whether the registry contains an entry named MyProgramLog1.
If EventLog.Delete does not find MyProgramLog1, an exception is thrown.

RESOLUTION

To work around this problem, instead of relying on the EventLog.Exists method to determine whether a log exists, an application confirms the existence of the following registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\<I BRACKET="YES">LogName</

where LogName is the name of the event log that you want to verify.

STATUS

Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

The following C# sample code demonstrates how to work around this problem by determining whether the registry contains an event log. If found, the EventLog.Delete() method deletes the log.

using System;
using System.Diagnostics;
using Microsoft.Win32;

class MyClass
{
   private const string LOG_NAME = "MyProgramLog1";
   private const string REG_PATH = 
         "SYSTEM\\CurrentControlSet\\Services\\Eventlog\\";

   public static void Main(string[] args)
   {   
      // Determine whether the log exists.
      RegistryKey eventLogKey = 
            Registry.LocalMachine.OpenSubKey(REG_PATH + LOG_NAME);
      if (eventLogKey == null) 
      {
         Console.WriteLine ("Log " + LOG_NAME + " not found.");
         return;
      }

      // Try to delete the log you just found.
      try
      {
         EventLog.Delete(LOG_NAME);
         Console.WriteLine ("Log " + LOG_NAME + " deleted.");
      }
      catch (Exception e)
      {
         Console.WriteLine ("Unable to delete log " + LOG_NAME + ".\n"
               + e.ToString());
      }
   }
}

Modification Type:	Major	Last Reviewed:	10/20/2003
Keywords:	kbbug kbKernBase kbnofix KB327890 kbAudDeveloper