How do I fix a custom Event Viewer Log that merges automatically with the Application log?
- by NightOwl888
I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\, it adds a log but shows the exact same events that are in the Application log when looking in the event viewer.
If I add a registry key with the name "(ML) Startup Commands 2" to the event log, it shows a blank event log as expected. In fact, any other name will work correctly except for the one I want.
I have searched through the registry for other keys with the string "(ML)" and removed all other references to this key name, however I continue to get merged results in the viewer when I create a key with this name.
My question is, how can I fix the server so I can create a custom event log with this name that shows only the events from my application, not the events from the default Application event log that is installed with Windows?
Update:
I rebooted the server and woudn't you know it, the log started acting normally. I got a strange error message in the Application log:
The EventSystem sub system is
suppressing duplicate event log
entries for a duration of 86400
seconds. The suppression timeout can
be controlled by a REG_DWORD value
named SuppressDuplicateDuration under
the following registry key:
HKLM\Software\Microsoft\EventSystem\EventLog.
For more information, see Help and
Support Center at
http://go.microsoft.com/fwlink/events.asp.
I can only hope this error doesn't mean the problem will come back after 86400 seconds. I guess I will have to wait and see.
