Thinking about using the Windows Event Logs as my main log store - looking for pros and cons

Question

I have been writing some larger scripts that write to physical log files.  Until today I have avoided trying to use the Windows Event logs, but, am beginning to rethink this and wondered if anyone has done this, and, what the strengths and weaknesses
of this logging approach has been.  If I do it, I will probably write a function that accepts pipelined input and simply pass output to the log.  I wanted to get a feel for what I would be getting into before I started writing things up since this
will probably take a little bit of work to get set up to run properly.

Answer 1

At my company we use the Windows event log for many of our batch process logging for several reasons:
Unlike logging to a central database, the Windows event log is always available. I've seen poorly thought out logging solution which log to a database and if the database happens to be unavailable the batch process would fail.
Monitoring tool such as SCOM already have Windows event log watchers so adding alerts to take action based on message written to the Windows event log is easy
Built-in support for writing Windows event log entries in the Powershell V2 write-eventlog cmdlet, a simple CLR can created in SQL Server or even command-line eventcreate.exe
Easy to create a custom event log so you don't have to use the default application log in Windows 2008 and higher.
Most shrink-wrap S/W already use the event log
Issues I've seen:
Windows 2008 with UAC on requires "registering" i.e. creating a new event log source with UAC. This can be done one time manually. Unfortunately there isn't a way to automate UAC--pure GUI. The Powershell command would be "New-EventLog -LogName Application
-Source  mysource" if you're using the Application log and must be run as  administrator.
Errant process writes many entries to the event log. Depending on the volume like for example writing stack dumps this can performance problems. I  think I recall an issue an Windows 2003 or Windows 2008 with UAC off  if you're creating a new
event log source each time (which you shouldn't) then these results in many registry entries which can cause problems.
I don't think the issues outweigh the benefits--just something to be aware of.