in src/log4net/Appender/EventLogAppender.cs [222:286]
public override void ActivateOptions()
{
try
{
base.ActivateOptions();
SecurityContext ??= SecurityContextProvider.DefaultProvider.CreateSecurityContext(this);
bool sourceAlreadyExists;
string? currentLogName = null;
using (SecurityContext.Impersonate(this))
{
sourceAlreadyExists = EventLog.SourceExists(ApplicationName);
if (sourceAlreadyExists)
{
currentLogName = EventLog.LogNameFromSourceName(ApplicationName, MachineName);
}
}
if (sourceAlreadyExists && currentLogName != LogName)
{
LogLog.Debug(_declaringType, $"Changing event source [{ApplicationName}] from log [{currentLogName}] to log [{LogName}]");
}
else if (!sourceAlreadyExists)
{
LogLog.Debug(_declaringType, $"Creating event source Source [{ApplicationName}] in log {LogName}]");
}
string? registeredLogName = null;
using (SecurityContext.Impersonate(this))
{
if (sourceAlreadyExists && currentLogName != LogName)
{
//
// Re-register this to the current application if the user has changed
// the application / logfile association
//
EventLog.DeleteEventSource(ApplicationName, MachineName);
CreateEventSource(ApplicationName, LogName, MachineName);
registeredLogName = EventLog.LogNameFromSourceName(ApplicationName, MachineName);
}
else if (!sourceAlreadyExists)
{
CreateEventSource(ApplicationName, LogName, MachineName);
registeredLogName = EventLog.LogNameFromSourceName(ApplicationName, MachineName);
}
}
_levelMapping.ActivateOptions();
LogLog.Debug(_declaringType, $"Source [{ApplicationName}] is registered to log [{registeredLogName}]");
}
catch (System.Security.SecurityException ex)
{
ErrorHandler.Error($"Caught a SecurityException trying to access the EventLog. Most likely the event source {ApplicationName}"
+ " doesn't exist and must be created by a local administrator. Will disable EventLogAppender."
+ " See http://logging.apache.org/log4net/release/faq.html#trouble-EventLog",
ex);
Threshold = Level.Off;
}
}