search

ahelland / ADFSMFAAdapters

Custom MFA Adapters for ADFS
38 stars 11 forks source link

EventLog generates dirty records #6

Closed ClosedCondition closed 4 years ago

ClosedCondition commented 5 years ago

All calls for EventLog.WriteEntry like this one: EventLog.WriteEntry("Application", "Config loaded with following authId: " + authId, EventLogEntryType.Information); generate very dirty messages in the Application EventLog that start with this text: The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

To create clean and easy read & filter records in the server EventLogs, find+replace Application with something like ADFSYubikey and an EventID at the end of WriteEntry: EventLog.WriteEntry("ADFSYubikey", "Config loaded with following authId: " + authId, EventLogEntryType.Information, 2019);

In order to make all these work, on the server must exist this Registry key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\ADFSYubikey] "EventMessageFile"="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\EventLogMessages.dll" Check your installed .NET version and update EventMessageFile value accordingly! Or just copy/paste simiar path for EventLogMessages.dll from other records.

ahelland commented 4 years ago

I borrowed a page from this book: https://www.jitbit.com/alexblog/266-writing-to-an-event-log-from-net-without-the-description-for-event-id-nonsense/

Using "AD FS" as source and finding event id 335 as being available I changed the logging accordingly. It will still appear in the "Application" log, but looks cleaner.