The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

Posted: February 16, 2012 in BizTalk
Tags: , ,

It’s very common to use .NET code for orchestration support and also to log errors, warnings or information in Event Viewer. I have as a principle, not to register this type of information on Application Event Log. For me this log is to be use by system applications like BizTalk, SharePoint and others, so if we register all custom information in this log, we can infest the log with unnecessary information and lose or difficult the visualization of important information. I advise the creation of one or more custom logs and for that I use this code:

if (!System.Diagnostics.EventLog.SourceExists(sourceName))
   System.Diagnostics.EventLog.CreateEventSource(sourceName, logName);
System.Diagnostics.EventLog.WriteEntry(sourceName, genericString.ToString(), logType);

However when I installed one BizTalk Application in a brand new environment I caught this error:

xlang/s engine event log entry: Uncaught exception (see the ‘inner exception’ below) has suspended an instance of service ‘My.Orchestrations.Orch(f0b8a3ff-15cd-03db-2c20-4530bda13468)’.
The service instance will remain suspended until administratively resumed or terminated.
If resumed the instance will continue from its last persisted state and may re-throw the same unexpected exception.
InstanceId: a69409e2-094c-4f5b-9dd6-f448eec3bd3c
Shape name: Response Error Construct Msg
ShapeId: 95ffeaaa-dd23-4c09-8e3e-7fcd07342a11
Exception thrown from: segment 3, progress 3
Inner exception: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

Another typical error is: You receive the “Requested registry access is not allowed” error message when you try to create a custom event log


This problem occurs because the user account that you used to log on does not have sufficient permissions.
The first time that you call the EventLog.CreateEventSource() method to create a custom event log, the custom event log entry is created under the following registry subkey:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

To create this subkey entry, you must have permission to write. However, the regular user account does not have permission to write.

So, the user that runs the application must have administrative rights to create a new event log source or a new custom log.


You need to grant permission to create a custom event log:

  • Log on to the computer as an administrator.
  • Click Start, click Run, type regedit in the Open box, and then click OK. The Registry Editor window appears.
  • Locate the following registry subkey:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  • Right-click Eventlog, and then click Permissions. The Permissions for Eventlog dialog box appears.


  • Click Add, add the user account or group that you want and set the following permissions: “Full Control”


Tags: BizTalk | Orchestration | Errors and Warnings, Causes and Solutions

  1. abhishek says:

    Hi Sandro,
    I have set permission for Biztalk Administrator .Still i am facing the same isssue .I am memeber of Biztalk Admin group. Do i need to restart Event log service as due to security issue I am unable to restart it .


    • Hi Abhishek,
      Try to expand, in the Registry Editor, the EventLog and check if your custom source exists there. If not create manually and set the right permissions.

      And remind that BizTalk process, normally, are not running under BizTalk Administration group, instead they normally running in BizTalk Applications Users Group or BizTalk Isolated Host Users. So you need to check the groups that you are using and set permissions to that users in the EventLog

  2. Tarun says:

    Hello Sandro,

    I faced similar issue today. It is resolved along with your steps, I need to update permission on “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security” also

    Thanks and Happy New Year…

  3. Scott Pearce says:

    Incorrect. The error is that the current user does not have permission to *search* through all the event log sources. So, it is line 1 of your code that is causing the error, NOT the creation of the event log source.

    Apparently, the solution is that event log sources should be created AT INSTALLATION TIME (when administrator privileges are being used for the install), and then assumed to exist at runtime.

  4. Theo verhage says:

    Hi Sandro,

    We are using BizTalk2013R2 on Microsoft Server 2012R2 running 64 bit. The Solutions are migrated from Biztalk2009.

    Your solution of the problem was not working for me but it was a great step in the right direction.
    For me it was a missing key in the eventLog “BizTalk-interfaces” with the direction to the dll “C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll”.
    After putting it in the regedit the pipeline component (dll with C# source and a BizTalk part in it) works well again.


    Best regards,
    Theo Verhage

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s