Friday, December 12, 2014

Inaccessible logs: Security

We are using Event Log quite a lot to log error messages from SSIS Packages, and sometimes there could be security issues when doing it.

One of the issues I encountered was the error

"The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security"

In French: "Erreur : la source est introuvable mais certains ou l'ensemble des journaux des événements n'ont pas pu faire l'objet d'une recherche.
Journaux inaccessibles : sécurité"

when logging with a custom Source in the Event Log

This error is happening because in order to use this Source, system has to access Security log, and the user that is running the SSIS Package has insufficient rights to access this log.

To add the user, go to regedit (Registry Editor), HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog

add a user that is running the SSIS Package (in my case it was NT AUTHORITY\Network Service) to Permissions (right click on key, then select "Permissions…") with Full Control to both eventlog and security keys