Comments on: Event Logging in Windows http://jalaj.net/2006/12/26/event-logging-in-windows/ A Technical Blog Tue, 13 May 2008 21:57:54 +0000 http://wordpress.org/?v=MU By: chinhan http://jalaj.net/2006/12/26/event-logging-in-windows/#comment-29543 chinhan Fri, 02 May 2008 07:42:59 +0000 http://jalaj.wordpress.com/2006/12/26/event-logging-in-windows/#comment-29543 The first description part depend on EventID, let use 1 to have a custom description. The first description part depend on EventID, let use 1 to have a custom description.

]]> By: Tanvi http://jalaj.net/2006/12/26/event-logging-in-windows/#comment-28862 Tanvi Sun, 16 Mar 2008 09:20:12 +0000 http://jalaj.wordpress.com/2006/12/26/event-logging-in-windows/#comment-28862 how to log in? this is a very unorganized competition..... how to log in? this is a very unorganized competition…..

]]> By: meindert http://jalaj.net/2006/12/26/event-logging-in-windows/#comment-28543 meindert Mon, 18 Feb 2008 11:31:11 +0000 http://jalaj.wordpress.com/2006/12/26/event-logging-in-windows/#comment-28543 I had the same 'problem' as Mercury. Have gotten around it by creating a simple MessageDLL containing no categories and one message type (CategoryId 0, EventID 1). I found the c++ code for this on http://www.codeproject.com/KB/system/eventlogging.aspx You will have to connect this dll to your 'source' name in the event viewer. Code below links the dll to the source 'Logger', writeregistry is a wrapper module to write the registry (Created by E.Spencer) Const MY_LOGGER_REG_PATH = "SYSTEM\CurrentControlSet\Services\Eventlog\Application\Logger" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "CategoryCount", ValDWord, "1" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "CategoryMessageFile", ValString, App.Path & "\MessageDLL.DLL" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "EventMessageFile", ValString, App.Path & "\MessageDLL.DLL" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "File", ValString, "%SystemRoot%\system32\config\Logger.evt" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "MaxSize", ValDWord, "524288" WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, "TypesSupported", ValDWord, "7" I had the same ‘problem’ as Mercury.
Have gotten around it by creating a simple MessageDLL containing no categories and one message type (CategoryId 0, EventID 1).
I found the c++ code for this on http://www.codeproject.com/KB/system/eventlogging.aspx

You will have to connect this dll to your ’source’ name in the event viewer. Code below links the dll to the source ‘Logger’, writeregistry is a wrapper module to write the registry (Created by E.Spencer)

Const MY_LOGGER_REG_PATH = “SYSTEM\CurrentControlSet\Services\Eventlog\Application\Logger”
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “CategoryCount”, ValDWord, “1″
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “CategoryMessageFile”, ValString, App.Path & “\MessageDLL.DLL”
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “EventMessageFile”, ValString, App.Path & “\MessageDLL.DLL”
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “File”, ValString, “%SystemRoot%\system32\config\Logger.evt”
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “MaxSize”, ValDWord, “524288″
WriteRegistry HKEY_LOCAL_MACHINE, MY_LOGGER_REG_PATH, “TypesSupported”, ValDWord, “7″

]]> By: Mercury http://jalaj.net/2006/12/26/event-logging-in-windows/#comment-3203 Mercury Thu, 24 May 2007 21:51:22 +0000 http://jalaj.wordpress.com/2006/12/26/event-logging-in-windows/#comment-3203 Hi, thanks for this info on logging events. This is a very good code sample. I wanted to use this code to log events from Excel VBA. It's working, but when I look at the event viewer (O/S WinServer 2003), the description is always prefixed with something like "The description for Event ID ( 65535 ) in Source ( blahblah ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Test msg." Is there any way to remove this first description part? It totally obscures the message, to the point where I wonder if this is a good way to log stuff. Thank you!! Hi, thanks for this info on logging events. This is a very good code sample.

I wanted to use this code to log events from Excel VBA. It’s working, but when I look at the event viewer (O/S WinServer 2003), the description is always prefixed with something like “The description for Event ID ( 65535 ) in Source ( blahblah ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Test msg.”

Is there any way to remove this first description part? It totally obscures the message, to the point where I wonder if this is a good way to log stuff. Thank you!!

]]>