oh yeah, forgot an important bit of information ... when a source is specified on SP2, the LogEvent fails with an error code 1722 (The RPC server is unavailable). Set the source to blank - and all is good.