The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

It’s very common to use .NET code for orchestration support and also to log errors, warnings or information in Event Viewer. I have as a principle, not to register this type of information on Application Event Log. For me, this log is to be used by system applications like BizTalk, SharePoint and others, so if we register all custom information in this log, we can infest the log with unnecessary information and lose or difficult the visualization of important information. I advise the creation of one or more custom logs and for that, I use this code:

if (!System.Diagnostics.EventLog.SourceExists(sourceName))
   System.Diagnostics.EventLog.CreateEventSource(sourceName, logName);
System.Diagnostics.EventLog.WriteEntry(sourceName, genericString.ToString(), logType);

However, when I installed one BizTalk Application in a brand new environment I caught this error:

xlang/s engine event log entry: Uncaught exception (see the ‘inner exception’ below) has suspended an instance of service ‘My.Orchestrations.Orch(f0b8a3ff-15cd-03db-2c20-4530bda13468)’.
The service instance will remain suspended until administratively resumed or terminated.
If resumed the instance will continue from its last persisted state and may re-throw the same unexpected exception.
InstanceId: a69409e2-094c-4f5b-9dd6-f448eec3bd3c
Shape name: Response Error Construct Msg
ShapeId: 95ffeaaa-dd23-4c09-8e3e-7fcd07342a11
Exception thrown from: segment 3, progress 3
Inner exception: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

Another typical error is: You receive the “Requested registry access is not allowed” error message when you try to create a custom event log


This problem occurs because the user account that you used to log on does not have sufficient permissions.
The first time that you call the EventLog.CreateEventSource() method to create a custom event log, the custom event log entry is created under the following registry subkey:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

To create this subkey entry, you must have permission to write. However, the regular user account does not have permission to write.

So, the user that runs the application must have administrative rights to create a new event log source or a new custom log.


You need to grant permission to create a custom event log:

  • Log on to the computer as an administrator.
  • Click Start, click Run, type Regedit in the Open box, and then click OK. The Registry Editor window appears.
  • Locate the following registry subkey:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  • Right-click Eventlog, and then click Permissions. The Permissions for Eventlog dialog box appears.
event viewer permissions
  • Click Add, add the user account or group that you want and set the following permissions: “Full Control”
event viewer permissions options
#1 Azure Monitoring Platform
Author: Sandro Pereira

Sandro Pereira lives in Portugal and works as a consultant at DevScope. In the past years, he has been working on implementing Integration scenarios both on-premises and cloud for various clients, each with different scenarios from a technical point of view, size, and criticality, using Microsoft Azure, Microsoft BizTalk Server and different technologies like AS2, EDI, RosettaNet, SAP, TIBCO etc. He is a regular blogger, international speaker, and technical reviewer of several BizTalk books all focused on Integration. He is also the author of the book “BizTalk Mapping Patterns & Best Practices”. He has been awarded MVP since 2011 for his contributions to the integration community.

8 thoughts on “The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.”

  1. Hi Sandro,
    I have set permission for Biztalk Administrator .Still i am facing the same isssue .I am memeber of Biztalk Admin group. Do i need to restart Event log service as due to security issue I am unable to restart it .


    1. Hi Abhishek,
      Try to expand, in the Registry Editor, the EventLog and check if your custom source exists there. If not create manually and set the right permissions.

      And remind that BizTalk process, normally, are not running under BizTalk Administration group, instead they normally running in BizTalk Applications Users Group or BizTalk Isolated Host Users. So you need to check the groups that you are using and set permissions to that users in the EventLog

  2. Hello Sandro,

    I faced similar issue today. It is resolved along with your steps, I need to update permission on “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLogSecurity” also

    Thanks and Happy New Year…

  3. Incorrect. The error is that the current user does not have permission to *search* through all the event log sources. So, it is line 1 of your code that is causing the error, NOT the creation of the event log source.

    Apparently, the solution is that event log sources should be created AT INSTALLATION TIME (when administrator privileges are being used for the install), and then assumed to exist at runtime.

  4. Hi Sandro,

    We are using BizTalk2013R2 on Microsoft Server 2012R2 running 64 bit. The Solutions are migrated from Biztalk2009.

    Your solution of the problem was not working for me but it was a great step in the right direction.
    For me it was a missing key in the eventLog “BizTalk-interfaces” with the direction to the dll “C:WindowsMicrosoft.NETFramework64v4.0.30319EventLogMessages.dll”.
    After putting it in the regedit the pipeline component (dll with C# source and a BizTalk part in it) works well again.


    Best regards,
    Theo Verhage

  5. Had similar issue, added the biztalk service account running the host instance to eventlog, still had the same issue, then added it the the Security subkey as well and issue was resolved.

  6. Below Solution work for me at BT2013.

    1.Go to 1 level more in deep in registry,like below:- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security.
    2.Right click on Security:
    3.Give full control to user owned BizTalk Orchestration.

Leave a Reply

Your email address will not be published. Required fields are marked *


Back to Top