Log Event Category

  • Thread starter Thread starter Paul J. Lay
  • Start date Start date
P

Paul J. Lay

Can anyone tell me how to add several event categories to the Window
Application Event Log? I have successfully registered a log source which
is registered under the Application.Log. The events are displayed perfectly
but it would be nice if I could display the events with my own event
categories since none of the currently defined categories match my
application.

Best Regards,

Paul J. Lay
 
Paul J. Lay said:
Can anyone tell me how to add several event categories to the Window
Application Event Log? I have successfully registered a log source which
is registered under the Application.Log. The events are displayed perfectly
but it would be nice if I could display the events with my own event
categories since none of the currently defined categories match my
application.
Click to expand...

At present, you'll have to use the Win32 APIs for this purpose. Check in the
Platform SDK documentation.

It appears they may be adding this functionality in .NET 2.0.
 
Hi you already have methods to create your own Even Log category
See the VB.Net code

EventLog.CreateEventSource(Source, LogName,MachineName(. for local)). All are string types.
Before creating the event Source check whether it is already exisitng b

EventLog.SourceExists(Source) functio

Sooraj P
Microsoft India Community Sta
 
Correct! I am using the EventLog.WriteEntryMethod. It works very well. My
question was about adding an event category which is displayed as a string
in the event viewer. I believe this parameter is refererenced as
EventLogEntryType in the WriteEntryMethod prototype which is passed in the
method as a short integer. How do I define a new type? The EventLog class
doesn't support that. Please advise. Thanks for your help.

Best Regards,

Paul J. Lay
 
You can't do it directly in .NET 1.0 or 1.1. You have to use the Win32 API.
This seems fixed in .NET 2.0.
 
Thanks for your prompt reply. I am wondering if you know off hand one of
the API functions that are used. This would really help me with my search.
Thanks for your help.

Best Regards,

Paul J. Lay
 
This is not completely true. Once of the overloads for the
EventLog.WriteEntry() method accepts five (5) parameters, the last of which
is a "short eCategory", which is an index that is translated into a string
by the Event Viewer software (and thus by the .Net interface as well). The
issue is that there does not appear to be a mechanism in .Net to define the
strings that represent these category codes. You are perfectly free to
specify any value for category that you wish.

The translations for the category codes are the same as for the translation
of the event ID into a string. These files are stored as string resources in
a special resource file that is referenced from the registry for the Event
Viewer. Basically one must build a message (MSG) file where the first
entries are the translations for the category codes and the remainder are
translations for the event IDs. This MSG file is compiled into a header and
data file that are linked into a resource table; a reference to the DLL that
contains this resource table is stored in the registry associated with that
Event Log and source, providing the translations.

Traditionally, the use of the Event Log system calls for specifying an Event
ID and a list of string values. The Event Viewer uses the event ID as a
translation into a string resource that is treated as a format string. The
typical style seen in .Net examples is to create Event Log entries which are
a single and complete text string that is the entire message that will be
displayed when someone views the entry. This is contrary to the classical
use where the formatted string is specified and the invoking code only
passes the dynamic parts of the final message.

In the past I have had experience with defining MSG files and linking the
results into a service (or even kernel module) image (EXE or SYS) that is
then referenced from the registry, and this works fine -- with Visual Studio
6. I have asked several times on various news groups and no one seems to
know if there is a way to permit the Event Log system to use the resources
from .Net, or whether one must still use the standard Visual Studio 6 style
of compiled resource file to generate these translation strings.

So the problem is not with being able to specify the category from .Net
code, but in being able to specify the specific translation for the category
code.

-Ken
 
Ken Allen said:
This is not completely true. Once of the overloads for the
EventLog.WriteEntry() method accepts five (5) parameters, the last of which
is a "short eCategory", which is an index that is translated into a string
by the Event Viewer software (and thus by the .Net interface as well). The
issue is that there does not appear to be a mechanism in .Net to define the
strings that represent these category codes. You are perfectly free to
specify any value for category that you wish.

The translations for the category codes are the same as for the translation
of the event ID into a string. These files are stored as string resources in
a special resource file that is referenced from the registry for the Event
Viewer. Basically one must build a message (MSG) file where the first
entries are the translations for the category codes and the remainder are
translations for the event IDs. This MSG file is compiled into a header and
data file that are linked into a resource table; a reference to the DLL that
contains this resource table is stored in the registry associated with that
Event Log and source, providing the translations.

Traditionally, the use of the Event Log system calls for specifying an Event
ID and a list of string values. The Event Viewer uses the event ID as a
translation into a string resource that is treated as a format string. The
typical style seen in .Net examples is to create Event Log entries which are
a single and complete text string that is the entire message that will be
displayed when someone views the entry. This is contrary to the classical
use where the formatted string is specified and the invoking code only
passes the dynamic parts of the final message.

In the past I have had experience with defining MSG files and linking the
results into a service (or even kernel module) image (EXE or SYS) that is
then referenced from the registry, and this works fine -- with Visual Studio
6. I have asked several times on various news groups and no one seems to
know if there is a way to permit the Event Log system to use the resources
from .Net, or whether one must still use the standard Visual Studio 6 style
of compiled resource file to generate these translation strings.

So the problem is not with being able to specify the category from .Net
code, but in being able to specify the specific translation for the category
code.
Click to expand...

Like I said! ;-)

Ken is correct, you can specify the category, but there's no simple way to
specify the string which should display. This seems to be addressed in .NET
2.0, which has a static
System.Diagnostics.EventLog.CreateEventSource(EventSourceCreationData)
method. EventSourceCreationData has properties for the resource files for
categories, messages and parameters.
 
Paul said:
Can anyone tell me how to add several event categories to the Window
Application Event Log? I have successfully registered a log source
which is registered under the Application.Log. The events are
displayed perfectly but it would be nice if I could display the
events with my own event categories since none of the currently
defined categories match my application.
Click to expand...

I wrote one of my newsletters for DDJ on this subject
(http://www.ddj.com/columns/dotnet/), the article is due to be published in
a week or so's time.

Basically to display a string for the event category you need to do this:

1) create a resource only Win32 DLL with a RT_MESSAGETABLE resource that
describe the categories, create the resource with the MC message compiler
and the RC resource compiler
2) register your source to use the resource file for categories

The article will have example code to show you how to do all of this.

#2 can be be done with this function:

static void CreateSource(string name, string msgFile, int count)

{

if (!EventLog.SourceExists(name))

EventLog.CreateEventSource(name, "Application");



RegistryKey hklm = Registry.LocalMachine;

string keyName = @"SYSTEM\CurrentControlSet\Services"

+ @"\EventLog\Application\"

+ name;

RegistryPermission perm = new RegistryPermission(

RegistryPermissionAccess.Create|RegistryPermissionAccess.Write,

@"HKEY_LOCAL_MACHINE\"+keyName);

RegistryKey el = hklm.OpenSubKey(keyName, true);

string file = Environment.CurrentDirectory + @"\" + msgFile;

try

{

el.SetValue("CategoryMessageFile", file);

el.SetValue("CategoryCount", count);

}

catch(Exception){}

}


Richard
 
Back
Top