Event Logging via ReportEvent API


DevX Home    Today's Headlines   Articles Archive   Tip Bank   Forums   

Results 1 to 7 of 7

Thread: Event Logging via ReportEvent API

  1. #1
    Andrew Shaw Guest

    Event Logging via ReportEvent API


    Hi,

    I'm trying to get NT Event Logging going via the Report Event API. I have
    a Message File which I know to be OK because my C code uses it fine (via
    ReportEvent).

    Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
    be valid (5), I get the following string in the log...

    The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
    be found. It contains the following insertion string(s): .

    I have not specified any insertion strings to use as the Message whose ID
    is 5 in the file, has no replacement strings. It is constant text.

    Do I need to add some magic number to my EventId perhaps or am I missing
    something really basic?

    Thanks in advance.

    Andrew Shaw
    (andrew.shaw@auspost.com.au)



  2. #2
    L.J. Johnson Guest

    Re: Event Logging via ReportEvent API

    Andrew,

    I have a complete working example of this on my website (below) from an
    article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
    5.0).

    Event logs *always* use insertion strings into a MC file, whether you want
    it to work that way or not -- it was *by design*. Therefore, if you want to
    avoid that annoying and unprofessional message, you *must* use a message
    file in a DLL or EXE and register it. And you can't do that file in any
    version of VB up thru 6.0. One workaround, and the one I used, is to create
    a generic message file, with *only* an insertion point (%1%), so everything
    you send is inserted.

    --
    L.J. Johnson, Slightly Tilted Software
    Microsoft MVP (Visual Basic)
    LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    <http://www.SlightlyTiltedSoftware.com>
    Ask The NT Pro at <http://www.inquiry.com>


    > I'm trying to get NT Event Logging going via the Report Event API. I have
    > a Message File which I know to be OK because my C code uses it fine (via
    > ReportEvent).
    >
    > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
    > be valid (5), I get the following string in the log...
    >
    > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
    > be found. It contains the following insertion string(s): .
    >
    > I have not specified any insertion strings to use as the Message whose ID
    > is 5 in the file, has no replacement strings. It is constant text.
    >
    > Do I need to add some magic number to my EventId perhaps or am I missing
    > something really basic?





  3. #3
    L.J. Johnson Guest

    Re: Event Logging via ReportEvent API

    Andrew,

    I have a complete working example of this on my website (below) from an
    article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
    5.0).

    Event logs *always* use insertion strings into a MC file, whether you want
    it to work that way or not -- it was *by design*. Therefore, if you want to
    avoid that annoying and unprofessional message, you *must* use a message
    file in a DLL or EXE and register it. And you can't do that file in any
    version of VB up thru 6.0. One workaround, and the one I used, is to create
    a generic message file, with *only* an insertion point (%1%), so everything
    you send is inserted.

    --
    L.J. Johnson, Slightly Tilted Software
    Microsoft MVP (Visual Basic)
    LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    <http://www.SlightlyTiltedSoftware.com>
    Ask The NT Pro at <http://www.inquiry.com>


    > I'm trying to get NT Event Logging going via the Report Event API. I have
    > a Message File which I know to be OK because my C code uses it fine (via
    > ReportEvent).
    >
    > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know to
    > be valid (5), I get the following string in the log...
    >
    > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could not
    > be found. It contains the following insertion string(s): .
    >
    > I have not specified any insertion strings to use as the Message whose ID
    > is 5 in the file, has no replacement strings. It is constant text.
    >
    > Do I need to add some magic number to my EventId perhaps or am I missing
    > something really basic?





  4. #4
    Patrick Long Guest

    Re: Event Logging via ReportEvent API

    LJ

    Do you have any good info on creating these message files please.

    Pat
    "L.J. Johnson" <ljjohnsn@flash.net> wrote in message
    news:39862e80@news.devx.com...
    > Andrew,
    >
    > I have a complete working example of this on my website (below) from an
    > article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
    > 5.0).
    >
    > Event logs *always* use insertion strings into a MC file, whether you want
    > it to work that way or not -- it was *by design*. Therefore, if you want

    to
    > avoid that annoying and unprofessional message, you *must* use a message
    > file in a DLL or EXE and register it. And you can't do that file in any
    > version of VB up thru 6.0. One workaround, and the one I used, is to

    create
    > a generic message file, with *only* an insertion point (%1%), so

    everything
    > you send is inserted.
    >
    > --
    > L.J. Johnson, Slightly Tilted Software
    > Microsoft MVP (Visual Basic)
    > LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    > <http://www.SlightlyTiltedSoftware.com>
    > Ask The NT Pro at <http://www.inquiry.com>
    >
    >
    > > I'm trying to get NT Event Logging going via the Report Event API. I

    have
    > > a Message File which I know to be OK because my C code uses it fine (via
    > > ReportEvent).
    > >
    > > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know

    to
    > > be valid (5), I get the following string in the log...
    > >
    > > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could

    not
    > > be found. It contains the following insertion string(s): .
    > >
    > > I have not specified any insertion strings to use as the Message whose

    ID
    > > is 5 in the file, has no replacement strings. It is constant text.
    > >
    > > Do I need to add some magic number to my EventId perhaps or am I missing
    > > something really basic?

    >
    >
    >




  5. #5
    Patrick Long Guest

    Re: Event Logging via ReportEvent API

    LJ

    Do you have any good info on creating these message files please.

    Pat
    "L.J. Johnson" <ljjohnsn@flash.net> wrote in message
    news:39862e80@news.devx.com...
    > Andrew,
    >
    > I have a complete working example of this on my website (below) from an
    > article I wrote for VBPJ years ago (it is in VB 4.0, but will work fine in
    > 5.0).
    >
    > Event logs *always* use insertion strings into a MC file, whether you want
    > it to work that way or not -- it was *by design*. Therefore, if you want

    to
    > avoid that annoying and unprofessional message, you *must* use a message
    > file in a DLL or EXE and register it. And you can't do that file in any
    > version of VB up thru 6.0. One workaround, and the one I used, is to

    create
    > a generic message file, with *only* an insertion point (%1%), so

    everything
    > you send is inserted.
    >
    > --
    > L.J. Johnson, Slightly Tilted Software
    > Microsoft MVP (Visual Basic)
    > LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    > <http://www.SlightlyTiltedSoftware.com>
    > Ask The NT Pro at <http://www.inquiry.com>
    >
    >
    > > I'm trying to get NT Event Logging going via the Report Event API. I

    have
    > > a Message File which I know to be OK because my C code uses it fine (via
    > > ReportEvent).
    > >
    > > Calling ReportEvent from VB6 (SP3) though for an Event ID which I know

    to
    > > be valid (5), I get the following string in the log...
    > >
    > > The description for Event ID ( 5 ) in Source ( NT-Log Monitor ) could

    not
    > > be found. It contains the following insertion string(s): .
    > >
    > > I have not specified any insertion strings to use as the Message whose

    ID
    > > is 5 in the file, has no replacement strings. It is constant text.
    > >
    > > Do I need to add some magic number to my EventId perhaps or am I missing
    > > something really basic?

    >
    >
    >




  6. #6
    L.J. Johnson Guest

    Re: Event Logging via ReportEvent API

    Patrick,

    Hello, long time no hear...

    > Do you have any good info on creating these message files please.


    Good, no. I had a devilish time finding *any* info.

    The following is from the Readme I included with the download...

    *******************************************
    For further information on the event logs, refer to the Windows Programming
    column in the March 1996 issue of VBPJ, and to the file WP0396.ZIP in the
    magazine section of VBPJ forum on CIS.

    Writing to the Application event log is an interesting experiment in
    mis-direction. The main problem is that, without getting many error
    messages, you must first have and register to the 32-bit Registry a DLL
    (actually, it could be an EXE) which contains a message resource. What is a
    message resource, you ask? Well, the documentation is kinda sketchy. Some
    information can be found on the MSDN, but even that is thin.

    Basically, you must create a text file of a fixed format. Then, you must
    compile that message file (*.MC) with the message compiler (MC.EXE). This
    program comes with VC++. Finally, you must include the compiled file you
    created with MC.EXE into a DLL with VC++ or one of the other 32-bit C
    compilers.

    For more information, see the January 1996 MSDN Level 1, disk #2, on the
    directory \MSDNSMPL\PROD\VC21\WIN32\LOGGING.

    Ideally, you would create a message-resource DLL for each program, that that
    DLL would contain strings associated with one or more specific EventID's
    specific for that program. Well, most VB programmer's don't have the VC++
    compiler.

    The included MSG_TEST.DLL is a perversion of MS's concept of a message
    resource -- i.e., it's a kludge for those who don't have a C compiler. This
    DLL contains 4 generic EventID strings:

    &H1&

    &H40000002

    &H80000003

    &HC0000004

    (The reason for the big numbers is kinda long-winded -- but they show up in
    the Event Viewer as 1, 2, 3, or 4).

    A normal message resource DLL would contain strings like:

    "The file %1 cannot be opened -- error is %2"

    You would then send strings to replace %1 and %2. However, each of the 4
    strings in MSG_TEST.DLL consists on of "%1." So, you send exactly ONE
    replacement string, and that is what will show up in the Description when
    you look at the details of an entry in the Application Event log.

    It is trivial to write events to a remote event log (if you have rights).
    However, you **MUST* register the MSG_TEST.DLL on that remote NT machine --
    or, instead of the expected string in the Description, you will get an error
    message. The button on the test form will register MSG_TEST.DLL (residing in
    the application directory) on the LOCAL machine only -- registering on a
    remote NT is left to the reader <g>.

    A test program (which uses the WriteEvt.DLL in-proc OLE server) is included.
    The easiest way to register the WriteEvt.DLL is to compile it as a DLL in VB
    4.0. This will register the in-proc server in the Registry. Then, bring up
    the test program, pick Tools/References, and uncheck "Write NT App Event
    Logs". Bring up Tools/References again, and check "Write NT App Event Logs".
    Now you should be able to run the test program. Use the button to register
    the MSG_TEST.DLL (make sure it's in the same directory that the test program
    is running from). Now, you can create entries in the application event log
    to your heart's content. Experiment and enjoy.

    --
    L.J. Johnson, Slightly Tilted Software
    Microsoft MVP (Visual Basic)
    LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    <http://www.SlightlyTiltedSoftware.com>
    Ask The NT Pro at <http://www.inquiry.com>




  7. #7
    L.J. Johnson Guest

    Re: Event Logging via ReportEvent API

    Patrick,

    Hello, long time no hear...

    > Do you have any good info on creating these message files please.


    Good, no. I had a devilish time finding *any* info.

    The following is from the Readme I included with the download...

    *******************************************
    For further information on the event logs, refer to the Windows Programming
    column in the March 1996 issue of VBPJ, and to the file WP0396.ZIP in the
    magazine section of VBPJ forum on CIS.

    Writing to the Application event log is an interesting experiment in
    mis-direction. The main problem is that, without getting many error
    messages, you must first have and register to the 32-bit Registry a DLL
    (actually, it could be an EXE) which contains a message resource. What is a
    message resource, you ask? Well, the documentation is kinda sketchy. Some
    information can be found on the MSDN, but even that is thin.

    Basically, you must create a text file of a fixed format. Then, you must
    compile that message file (*.MC) with the message compiler (MC.EXE). This
    program comes with VC++. Finally, you must include the compiled file you
    created with MC.EXE into a DLL with VC++ or one of the other 32-bit C
    compilers.

    For more information, see the January 1996 MSDN Level 1, disk #2, on the
    directory \MSDNSMPL\PROD\VC21\WIN32\LOGGING.

    Ideally, you would create a message-resource DLL for each program, that that
    DLL would contain strings associated with one or more specific EventID's
    specific for that program. Well, most VB programmer's don't have the VC++
    compiler.

    The included MSG_TEST.DLL is a perversion of MS's concept of a message
    resource -- i.e., it's a kludge for those who don't have a C compiler. This
    DLL contains 4 generic EventID strings:

    &H1&

    &H40000002

    &H80000003

    &HC0000004

    (The reason for the big numbers is kinda long-winded -- but they show up in
    the Event Viewer as 1, 2, 3, or 4).

    A normal message resource DLL would contain strings like:

    "The file %1 cannot be opened -- error is %2"

    You would then send strings to replace %1 and %2. However, each of the 4
    strings in MSG_TEST.DLL consists on of "%1." So, you send exactly ONE
    replacement string, and that is what will show up in the Description when
    you look at the details of an entry in the Application Event log.

    It is trivial to write events to a remote event log (if you have rights).
    However, you **MUST* register the MSG_TEST.DLL on that remote NT machine --
    or, instead of the expected string in the Description, you will get an error
    message. The button on the test form will register MSG_TEST.DLL (residing in
    the application directory) on the LOCAL machine only -- registering on a
    remote NT is left to the reader <g>.

    A test program (which uses the WriteEvt.DLL in-proc OLE server) is included.
    The easiest way to register the WriteEvt.DLL is to compile it as a DLL in VB
    4.0. This will register the in-proc server in the Registry. Then, bring up
    the test program, pick Tools/References, and uncheck "Write NT App Event
    Logs". Bring up Tools/References again, and check "Write NT App Event Logs".
    Now you should be able to run the test program. Use the button to register
    the MSG_TEST.DLL (make sure it's in the same directory that the test program
    is running from). Now, you can create entries in the application event log
    to your heart's content. Experiment and enjoy.

    --
    L.J. Johnson, Slightly Tilted Software
    Microsoft MVP (Visual Basic)
    LJJohnson@SlightlyTiltedSoftware.com or LJJohnson@mvps.org
    <http://www.SlightlyTiltedSoftware.com>
    Ask The NT Pro at <http://www.inquiry.com>




Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
HTML5 Development Center
 
 
FAQ
Latest Articles
Java
.NET
XML
Database
Enterprise
Questions? Contact us.
C++
Web Development
Wireless
Latest Tips
Open Source


   Development Centers

   -- Android Development Center
   -- Cloud Development Project Center
   -- HTML5 Development Center
   -- Windows Mobile Development Center