Friday, May 17, 2013

The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security

Writing to ULS log from Sharepoint e-mail event receiver

In case you are trying to use Sharepoint event logging infrastructure and its SPDiagnosticsService class from Sharepoint e-mail event receiver to write to the Windows Event Log or Sharepoint ULS log you might get this error: 

The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security

Or even worse, if you are not using Visual Studio 2010 debugger, but only rely on Event Viewer, you could see this error in Applications and Services Logs > Microsoft > Sharepoint Products > Shared > Operational:

An error occurred while processing the incoming e-mail file C:\inetpub\mailroot\Drop\3692ac8b01cc95a86666866.eml. The error was: Object reference not set to an instance of an object.

As you might know, SPEmailEventReceiver is running in owstimer.exe process which is actually "Sharepoint 2010 Timer" service. This service by default runs under NETWORK SERVICE account which does not have enough permissions to the Security log and this is the reason why SPDiagnosticsService class methods WriteTrace and WriteEvent will fail.

The solution I found is to add the NETWORK SERVICE account to the "Performance Log Users" Windows Security group and then restart the Sharepoint 2010 Timer service.

No comments:

Post a Comment