* The opening of an eventlog handle is a fairly low cost operation so I can't see a problem with doing it.  The log message frequency of the Puppet Agent service is very low during normal operations and even when in debug mode the frequency would be restricted to how long a catalog run is.
* I'm not sure about the thread safety of that handle as service control messages are on a different thread than the mainline

* Josh Cooper made a good point in a previous PR, in that I needed to do a .close to make sure I didn't get any handle leaks.  So what would happen in this instance if we had a global handle?;

1. Service starts
2. Logs events to the eventlog for a while
3. One eventlog message fails

What state is the handle in now?
Do we need to close the global handle and get a new one?
Will this cause leaks?

I think it is better to take the performance hit (very very small) each eventlog entry instead of managing the complexity of cross-thread handles and error management.