Event Logging via ReportEvent API

[Andrew Shaw]

Hi,

I'm trying to get NT Event Logging going via the Report Event API. I have
a Message File which I know to be OK because my C code uses it fine (via
ReportEvent).

Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
be valid (5), I get the following string in the log...

The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
be found. It contains the following insertion string(s): .

I have not specified any insertion strings to use as the Message whose ID
is 5 in the file, has no replacement strings. It is constant text.

Do I need to add some magic number to my EventId perhaps or am I missing
something really basic?

Thanks in advance.

Andrew Shaw
(andrew.shaw@auspost.com.au)

[L.J. Johnson]

Andrew,

I have a complete working example of this on my website (below) from an
article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
5.0).

Event logs *always* use insertion strings into a MC file, whether you want
it to work that way or not -- it was *by design*. Therefore, if you want to
avoid that annoying and unprofessional message, you *must* use a message
file in a DLL or EXE and register it. And you can't do that file in any
version of VB up thru 6.0. One workaround, and the one I used, is to create
a generic message file, with *only* an insertion point (%1%), so everything
you send is inserted.

--
L.J. Johnson, Slightly Tilted Software
Microsoft MVP (Visual Basic)
LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
<http://www.SlightlyTiltedSoftware.com>
Ask The NT Pro at <http://www.inquiry.com>


> I'm trying to get NT Event Logging going via the Report Event API. I have
> a Message File which I know to be OK because my C code uses it fine (via
> ReportEvent).
>
> Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
> be valid (5), I get the following string in the log...
>
> The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
> be found. It contains the following insertion string(s): .
>
> I have not specified any insertion strings to use as the Message whose ID
> is 5 in the file, has no replacement strings. It is constant text.
>
> Do I need to add some magic number to my EventId perhaps or am I missing
> something really basic?

[Patrick Long]

LJ

Do you have any good info on creating these message files please.

Pat
"L.J. Johnson" <ljjohnsn@flash.net> wrote in message
news:39862e80@news.devx.com...
> Andrew,
>
> I have a complete working example of this on my website (below) from an
> article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
> 5.0).
>
> Event logs *always* use insertion strings into a MC file, whether you want
> it to work that way or not -- it was *by design*. Therefore, if you want
to
> avoid that annoying and unprofessional message, you *must* use a message
> file in a DLL or EXE and register it. And you can't do that file in any
> version of VB up thru 6.0. One workaround, and the one I used, is to
create
> a generic message file, with *only* an insertion point (%1%), so
everything
> you send is inserted.
>
> --
> L.J. Johnson, Slightly Tilted Software
> Microsoft MVP (Visual Basic)
> LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
> <http://www.SlightlyTiltedSoftware.com>
> Ask The NT Pro at <http://www.inquiry.com>
>
>
> > I'm trying to get NT Event Logging going via the Report Event API. I
have
> > a Message File which I know to be OK because my C code uses it fine (via
> > ReportEvent).
> >
> > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know
to
> > be valid (5), I get the following string in the log...
> >
> > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could
not
> > be found. It contains the following insertion string(s): .
> >
> > I have not specified any insertion strings to use as the Message whose
ID
> > is 5 in the file, has no replacement strings. It is constant text.
> >
> > Do I need to add some magic number to my EventId perhaps or am I missing
> > something really basic?
>
>
>

[L.J. Johnson]

Patrick,

Hello, long time no hear...

> Do you have any good info on creating these message files please.

Good, no. I had a devilish time finding *any* info.

The following is from the Readme I included with the download...

*******************************************
For further information on the event logs, refer to the Windows Programming
column in the March 1996 issue of VBPJ, and to the file WP0396.ZIP in the
magazine section of VBPJ forum on CIS.

Writing to the Application event log is an interesting experiment in
mis-direction. The main problem is that, without getting many error
messages, you must first have and register to the 32-bit Registry a DLL
(actually, it could be an EXE) which contains a message resource. What is a
message resource, you ask? Well, the documentation is kinda sketchy. Some
information can be found on the MSDN, but even that is thin.

Basically, you must create a text file of a fixed format. Then, you must
compile that message file (*.MC) with the message compiler (MC.EXE). This
program comes with VC++. Finally, you must include the compiled file you
created with MC.EXE into a DLL with VC++ or one of the other 32-bit C
compilers.

For more information, see the January 1996 MSDN Level 1, disk #2, on the
directory \MSDNSMPL\PROD\VC21\WIN32\LOGGING.

Ideally, you would create a message-resource DLL for each program, that that
DLL would contain strings associated with one or more specific EventID's
specific for that program. Well, most VB programmer's don't have the VC++
compiler.

The included MSG_TEST.DLL is a perversion of MS's concept of a message
resource -- i.e., it's a kludge for those who don't have a C compiler. This
DLL contains 4 generic EventID strings:

&H1&

&H40000002

&H80000003

&HC0000004

(The reason for the big numbers is kinda long-winded -- but they show up in
the Event Viewer as 1, 2, 3, or 4).

A normal message resource DLL would contain strings like:

"The file %1 cannot be opened -- error is %2"

You would then send strings to replace %1 and %2. However, each of the 4
strings in MSG_TEST.DLL consists on of "%1." So, you send exactly ONE
replacement string, and that is what will show up in the Description when
you look at the details of an entry in the Application Event log.

It is trivial to write events to a remote event log (if you have rights).
However, you **MUST* register the MSG_TEST.DLL on that remote NT machine --
or, instead of the expected string in the Description, you will get an error
message. The button on the test form will register MSG_TEST.DLL (residing in
the application directory) on the LOCAL machine only -- registering on a
remote NT is left to the reader <g>.

A test program (which uses the WriteEvt.DLL in-proc OLE server) is included.
The easiest way to register the WriteEvt.DLL is to compile it as a DLL in VB
4.0. This will register the in-proc server in the Registry. Then, bring up
the test program, pick Tools/References, and uncheck "Write NT App Event
Logs". Bring up Tools/References again, and check "Write NT App Event Logs".
Now you should be able to run the test program. Use the button to register
the MSG_TEST.DLL (make sure it's in the same directory that the test program
is running from). Now, you can create entries in the application event log
to your heart's content. Experiment and enjoy.

--
L.J. Johnson, Slightly Tilted Software
Microsoft MVP (Visual Basic)
LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
<http://www.SlightlyTiltedSoftware.com>
Ask The NT Pro at <http://www.inquiry.com>

[L.J. Johnson]

Andrew,

I have a complete working example of this on my website (below) from an
article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
5.0).

Event logs *always* use insertion strings into a MC file, whether you want
it to work that way or not -- it was *by design*. Therefore, if you want to
avoid that annoying and unprofessional message, you *must* use a message
file in a DLL or EXE and register it. And you can't do that file in any
version of VB up thru 6.0. One workaround, and the one I used, is to create
a generic message file, with *only* an insertion point (%1%), so everything
you send is inserted.

--
L.J. Johnson, Slightly Tilted Software
Microsoft MVP (Visual Basic)
LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
<http://www.SlightlyTiltedSoftware.com>
Ask The NT Pro at <http://www.inquiry.com>


> I'm trying to get NT Event Logging going via the Report Event API. I have
> a Message File which I know to be OK because my C code uses it fine (via
> ReportEvent).
>
> Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
> be valid (5), I get the following string in the log...
>
> The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
> be found. It contains the following insertion string(s): .
>
> I have not specified any insertion strings to use as the Message whose ID
> is 5 in the file, has no replacement strings. It is constant text.
>
> Do I need to add some magic number to my EventId perhaps or am I missing
> something really basic?

[Patrick Long]

LJ

Do you have any good info on creating these message files please.

Pat
"L.J. Johnson" <ljjohnsn@flash.net> wrote in message
news:39862e80@news.devx.com...
> Andrew,
>
> I have a complete working example of this on my website (below) from an
> article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
> 5.0).
>
> Event logs *always* use insertion strings into a MC file, whether you want
> it to work that way or not -- it was *by design*. Therefore, if you want
to
> avoid that annoying and unprofessional message, you *must* use a message
> file in a DLL or EXE and register it. And you can't do that file in any
> version of VB up thru 6.0. One workaround, and the one I used, is to
create
> a generic message file, with *only* an insertion point (%1%), so
everything
> you send is inserted.
>
> --
> L.J. Johnson, Slightly Tilted Software
> Microsoft MVP (Visual Basic)
> LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
> <http://www.SlightlyTiltedSoftware.com>
> Ask The NT Pro at <http://www.inquiry.com>
>
>
> > I'm trying to get NT Event Logging going via the Report Event API. I
have
> > a Message File which I know to be OK because my C code uses it fine (via
> > ReportEvent).
> >
> > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know
to
> > be valid (5), I get the following string in the log...
> >
> > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could
not
> > be found. It contains the following insertion string(s): .
> >
> > I have not specified any insertion strings to use as the Message whose
ID
> > is 5 in the file, has no replacement strings. It is constant text.
> >
> > Do I need to add some magic number to my EventId perhaps or am I missing
> > something really basic?
>
>
>

[L.J. Johnson]

Patrick,

Hello, long time no hear...

> Do you have any good info on creating these message files please.

Good, no. I had a devilish time finding *any* info.

The following is from the Readme I included with the download...

*******************************************
For further information on the event logs, refer to the Windows Programming
column in the March 1996 issue of VBPJ, and to the file WP0396.ZIP in the
magazine section of VBPJ forum on CIS.

Writing to the Application event log is an interesting experiment in
mis-direction. The main problem is that, without getting many error
messages, you must first have and register to the 32-bit Registry a DLL
(actually, it could be an EXE) which contains a message resource. What is a
message resource, you ask? Well, the documentation is kinda sketchy. Some
information can be found on the MSDN, but even that is thin.

Basically, you must create a text file of a fixed format. Then, you must
compile that message file (*.MC) with the message compiler (MC.EXE). This
program comes with VC++. Finally, you must include the compiled file you
created with MC.EXE into a DLL with VC++ or one of the other 32-bit C
compilers.

For more information, see the January 1996 MSDN Level 1, disk #2, on the
directory \MSDNSMPL\PROD\VC21\WIN32\LOGGING.

Ideally, you would create a message-resource DLL for each program, that that
DLL would contain strings associated with one or more specific EventID's
specific for that program. Well, most VB programmer's don't have the VC++
compiler.

The included MSG_TEST.DLL is a perversion of MS's concept of a message
resource -- i.e., it's a kludge for those who don't have a C compiler. This
DLL contains 4 generic EventID strings:

&H1&

&H40000002

&H80000003

&HC0000004

(The reason for the big numbers is kinda long-winded -- but they show up in
the Event Viewer as 1, 2, 3, or 4).

A normal message resource DLL would contain strings like:

"The file %1 cannot be opened -- error is %2"

You would then send strings to replace %1 and %2. However, each of the 4
strings in MSG_TEST.DLL consists on of "%1." So, you send exactly ONE
replacement string, and that is what will show up in the Description when
you look at the details of an entry in the Application Event log.

It is trivial to write events to a remote event log (if you have rights).
However, you **MUST* register the MSG_TEST.DLL on that remote NT machine --
or, instead of the expected string in the Description, you will get an error
message. The button on the test form will register MSG_TEST.DLL (residing in
the application directory) on the LOCAL machine only -- registering on a
remote NT is left to the reader <g>.

A test program (which uses the WriteEvt.DLL in-proc OLE server) is included.
The easiest way to register the WriteEvt.DLL is to compile it as a DLL in VB
4.0. This will register the in-proc server in the Registry. Then, bring up
the test program, pick Tools/References, and uncheck "Write NT App Event
Logs". Bring up Tools/References again, and check "Write NT App Event Logs".
Now you should be able to run the test program. Use the button to register
the MSG_TEST.DLL (make sure it's in the same directory that the test program
is running from). Now, you can create entries in the application event log
to your heart's content. Experiment and enjoy.

--
L.J. Johnson, Slightly Tilted Software
Microsoft MVP (Visual Basic)
LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
<http://www.SlightlyTiltedSoftware.com>
Ask The NT Pro at <http://www.inquiry.com>