c# print barcode font See Also in Visual Studio .NET

Generator Quick Response Code in Visual Studio .NET See Also

For information about registering event sources programmatically, see Microsoft Knowledge Base article 329291, PRB: Requested Registry Access Is Not Allowed Error Message When ASP.NET Application Tries to Write New EventSource in the EventLog on the Support page of the Microsoft Web site at http://support.microsoft.com/ kbid=329291.

Next, create a method (and possibly a class or an assembly) to handle error logging. Depending on your needs, this can be a simple method that accepts a string error mes sage, or an Exception object, or a more complex class that accepts multiple applicationspecific parameters. After you centralize error handling for your application, create code to add an event to the event log with the relevant information. The following method does this:

2-49

private void Report_Error(Exception ex, EventLogEntryType type, int eventID,

short category)

EventLog myLog = new EventLog( Application );

myLog.Source = My Application";

myLog.WriteEntry( An exception occurred: + ex.Message, type,

eventID, category); } Private Sub Report_Error(ByVal ex As Exception, ByVal type As EventLogEnTryType, ByVal eventID As Integer, ByVal category As Short) Dim myLog As EventLog = New EventLog( Application ) myLog.Source = My Application" myLog.WriteEnTry( An exception occurred: + ex.Message, type, eventID, category) End Sub

Tip Create overloaded error reporting methods to give yourself more flexibility for reporting errors. For example, create a method that accepts an exception, another method that accepts a string, and a third method that accepts a combination of both.

Finally, write code to call the method whenever something worthy of an administrator s attention occurs within your application. The following code segment would catch exceptions and pass them on to the Report_Error method:

catch (Exception ex)

Report_Error(ex, EventLogEntryType.Error, 100, 200);

Report_Error(ex, EventLogEnTryType.Error, 100, 200)

Storing information in the server s Application event log represents an ideal way to report errors, because only the systems administrators will have access to read the event log. Additionally, systems administrators have a wide variety of tools available to analyze and aggregate event logs, simplifying management of the information. How ever, examining the event log is a tedious process during debugging. For that reason, you might choose to display detailed error messages to users connected directly to the application server, users who are members of the Administrators group, or users who are on the server s local subnet.

2-50

2

For Web requests, you can determine whether the user is connecting from the local computer by comparing the user s IP address with the value 127.0.0.1 , a special value used only by the local computer:

if (Request.UserHostAddress == 127.0.0.1 ) { // User is connecting from the local computer } If Request.UserHostAddress = 127.0.0.1 Then User is connecting from the local computer End If

For more information about examining user group memberships, see 5, Implementing Role-Based Security.

To reduce the risk of denial-of-service attacks, you should close all open connections when an unhandled exception occurs. Otherwise, an attacker can repeatedly generate an error and intentionally consume the entire pool of available connections. The most common example of a limited connection pool is connecting to a database. The fol lowing code shows how to use finally to close an open connection after an exception occurs:

SqlConnection conn = new SqlConnection(connectString);

catch (SqlException sqlex)

// Handle exception and report the error Report_Error(sqlex, EventLogEnTryType.Error, 100, 200);

2-51

Dim conn As SqlConnection = New SqlConnection(connectString)

conn.Open()

Report_Error(sqlex, EventLogEnTryType.Error, 100, 200)

Although most exceptions and failures have benign causes, such as an unavailable net work resource, you should always assume that a failure has been intentionally induced by an attacker. Specifically, after you understand code access security, you should write code that defaults to a permission set that is more secure than the permission set that existed before the errors or issues occurred.