The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

Posted: February 16, 2012 in BizTalk
Tags: , ,

It’s very common to use .NET code for orchestration support and also to log errors, warnings or information in Event Viewer. I have as a principle, not to register this type of information on Application Event Log. For me this log is to be use by system applications like BizTalk, SharePoint and others, so if we register all custom information in this log, we can infest the log with unnecessary information and lose or difficult the visualization of important information. I advise the creation of one or more custom logs and for that I use this code:

if (!System.Diagnostics.EventLog.SourceExists(sourceName))
{
   System.Diagnostics.EventLog.CreateEventSource(sourceName, logName);
}
System.Diagnostics.EventLog.WriteEntry(sourceName, genericString.ToString(), logType);

However when I installed one BizTalk Application in a brand new environment I caught this error:

xlang/s engine event log entry: Uncaught exception (see the ‘inner exception’ below) has suspended an instance of service ‘My.Orchestrations.Orch(f0b8a3ff-15cd-03db-2c20-4530bda13468)’.
The service instance will remain suspended until administratively resumed or terminated.
If resumed the instance will continue from its last persisted state and may re-throw the same unexpected exception.
InstanceId: a69409e2-094c-4f5b-9dd6-f448eec3bd3c
Shape name: Response Error Construct Msg
ShapeId: 95ffeaaa-dd23-4c09-8e3e-7fcd07342a11
Exception thrown from: segment 3, progress 3
Inner exception: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

Another typical error is: You receive the “Requested registry access is not allowed” error message when you try to create a custom event log

CAUSE

This problem occurs because the user account that you used to log on does not have sufficient permissions.
The first time that you call the EventLog.CreateEventSource() method to create a custom event log, the custom event log entry is created under the following registry subkey:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

To create this subkey entry, you must have permission to write. However, the regular user account does not have permission to write.

So, the user that runs the application must have administrative rights to create a new event log source or a new custom log.

SOLUTION

You need to grant permission to create a custom event log:

  • Log on to the computer as an administrator.
  • Click Start, click Run, type regedit in the Open box, and then click OK. The Registry Editor window appears.
  • Locate the following registry subkey:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  • Right-click Eventlog, and then click Permissions. The Permissions for Eventlog dialog box appears.

eventviewer-permissions

  • Click Add, add the user account or group that you want and set the following permissions: “Full Control”

eventviewer-permissions-options

Tags: BizTalk | Orchestration | Errors and Warnings, Causes and Solutions

About these ads
Comments
  1. abhishek says:

    Hi Sandro,
    I have set permission for Biztalk Administrator .Still i am facing the same isssue .I am memeber of Biztalk Admin group. Do i need to restart Event log service as due to security issue I am unable to restart it .

    Thanks
    Abhishek

    • Hi Abhishek,
      Try to expand, in the Registry Editor, the EventLog and check if your custom source exists there. If not create manually and set the right permissions.

      And remind that BizTalk process, normally, are not running under BizTalk Administration group, instead they normally running in BizTalk Applications Users Group or BizTalk Isolated Host Users. So you need to check the groups that you are using and set permissions to that users in the EventLog

  2. Tarun says:

    Hello Sandro,

    I faced similar issue today. It is resolved along with your steps, I need to update permission on “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security” also

    Thanks and Happy New Year…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s