Types of Event Log Entries
When you write an entry to a log, you specify the type of entry you're making. The following table lists the types of events and their contents.
Entry Type |
Contents |
|---|---|
Information |
An information event indicates an infrequent but significant successful operation. For example, when Microsoft SQL Server successfully loads, it may be appropriate to log an information event stating that "SQL Server has started." Note that while this is appropriate behavior for major server services, it is generally inappropriate for a desktop application to log an event each time it starts. |
Warning |
A warning event indicates a problem that is not immediately significant but that may cause future complications. Resource consumption is a good candidate for a warning event. For example, an application can log a warning event if disk space is low. If an application can recover from an event without loss of functionality or data, it can generally classify the event as a warning event. |
Error |
An error event indicates a significant problem the user should know about, such as a loss of functionality or data. For example, if a service cannot be loaded as the system boots, it can log an error event. |
Success audit |
A success audit event is a security event that occurs when an audited access attempt is successful. For example, a successful logon attempt is a success audit event. |
Failure audit |
A failure audit event is a security event that occurs when an audited access attempt fails. For example, a failed attempt to open a file is a failure audit event. |
By default, the event type is set to Information if you do not specify otherwise. You can set the type by using a parameter on an overloaded form of the WriteEntry method. When you are reading log entries, you can query the EntryType property on the EventLogEntry class to see what type of entry you are working with.
See Also
Tasks
Walkthrough: Exploring Event Logs, Event Sources, and Entries