The System.Diagnostics.EventLogTraceListener class, when set up log WCF traffic, can cause a memory leak when attempting to Log Service traffic, if the Event Log Source (specified in the “initializeData” attribute of the Event Log Listener configuration element) doesn’t previously exist and the Service is running under a User, without sufficient privileges to create a new Event Log source.
The EventLogTraceListener class appears to dutifully try to create the new Event Log source, finds itself with insufficient privileges and then just dies leaving Handles open related to Event Log Registry entries.
This came to light, when a poorly configured load balancer, rapidly polling a WCF service host for connectivity, induced massive amounts of Logged errors. Not only were the errors not being logged in all cases, a terrific memory leak shutdown the Virtual Server within a half hour. A little poking around with the Process Explorer utility, revealed the amount of Handles growing terrifically in synch with the load balancer’s polling efforts. Some further analysis indicated the culprit to be a badly configured WCF logging configuration. The specific Event Log Source was changed to an existing one and the problem evaporated.
The best solution for Event Log Source creation is to use a specific task within the Custom Installer. Installers are usually executed by personnel with sufficient rights to create the necessary Event Log Sources for the application.