1

Somebody gave me a testing program to write records into the windows event log (but I don't have the sources). I understand the general way of writing and reviewing event log, but that program behaves very special in a way that I can write records, that have a source which does not exist. There is not even a registry entry in .../eventlog/application, hence no formatting libs.

If I try that from my own code, I can write such a record but the Windows Event Viewer then always tells me something about "description cannot be found" (which is correct and I understand why that happens).

The question is now: Since that foreign test prog CAN do it, it must be possible somehow - but HOW?

Many thx!! :-)

Improve this question

1 Answer 1

Reset to default
1

OK, finally I found it (also, got the sources) - the prog creates the registry entry (probably happens when calling CreateEventSource()), it was just not visible until refreshing regedit :-|

And, it DOES register a formatting lib, only that it is something I cannot rely on: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll

Or, can I?

Ah, here we go for an explanation: Difference between EventLog.WriteEntry and EventLog.WriteEvent methods So, I cannot, as I'm not using .Net ... :-|

Now, if I NOW send another event from MY prog (with the same, newly created source, as the foreign prog), I see it in the event viewer normally. That means, WriteEntry() actually does not write a different/special type of evt log record containing the text directly (contrary to the standard method of writing just a msg catalog ID + params) but rather there must be some trick in the formatting lib to make the EventViewer apply some kind of "default" formatting.

Any ideas how I could accomplish this? Except just copying the EventLogMessages.dll above? :-)

OK, finally found an answer about this one in http://msdn.microsoft.com/en-us/magazine/cc163446.aspx "This file is called EventLogMessages.dll, and it contains 65,536 event descriptions, each of which consists of the string "%1", a placeholder for whatever string you want to write"

I was hoping for something like "messageid=*" but that seems to be too simple :-|

But maybe somebody else is interested in whats happening here ...

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.