NT Event Log

[bob bird]

Event Viewer in NT has a facility to call a registered Application DLL. Where does one find the interface specifications for this user supplied DLL

[Dmitriy]

I do nothing about it. Where comes this info from?

Dmitriy, MCSE

[bob bird]

This is to allow the Event Viewer to use a message file to format and display event data as per RegisterEventSource()

[Dmitriy]

Yes, but I found nothing about dll.
I think you can just use Event Viewer to log your events by using RegisterEventSource(), ReportEvent(), ..., no more.
Event Viewer does not generate any messages.


Dmitriy, MCSE

[bob bird]

while not having the dll or exe linked allows you add to the event log, the message "The description for Event ID ( 1 ) in Source ( App Name ) could not be found." will be included in error message. It is this section the the DLL helps format and provides the user with relevant information.

ie VirusScan NT McShield service started - scanning for 45212 viruses.
Extra driver name : none

[Dmitriy]

Ok, it is interesting question. What coul I find:
1) I try this code:
char* lpBuf=(char*) malloc(80);
strcpy(lpBuf,"Test");
HANDLE h=RegisterEventSource(NULL,AfxGetAppName());
ASSERT(h);
BOOL bRet=ReportEvent(h,EVENTLOG_INFORMATION_TYPE,
IDE_TEST,//for test
IDE_TEST, // event identifier
NULL, // user security identifier (optional)
1, // number of strings to merge with message
0, // size of binary data, in bytes
(LPCTSTR*) &lpBuf, // array of strings to merge with message
NULL);
bRet=CloseEventLog(h);

but it does not work.
Something from Microsoft knowledgebase:
"A version of the Logging sample failed to include the .RC file as part of the build in the makefile. So the DLL is built, but no message resources were included in the build. Some developers have tried to include the .BIN file, which is output from the message compiler, as the resource. This does not properly bind the resource to the DLL. You must use the .RC file that is output from the message compiler because it marks the resource with ID of 1 and of type 11 (RT_MESSAGETABLE). This is required for Event Viewer to find the message resources.
"
I think the problem near.
The article is Q166902


Dmitriy, MCSE