.MC file and Event Viewer: Placeholders for Categories?
I am using MFC in order to throw events in a custom event log of the windows
event viewer. I am using a .MC file where I store the Categories and the
message definitions used for the events fired on the event viewer.
.MC contains only one message definition since I use a placeholder (%1) in
order to load the messages dynamically from my application.
The 4th argument of the Report Event is:
dwEventID [in] The event identifier.The event identifier specifies the entry
in the message file associated with the event source.
The 8th argument is:
pStrings [in] A pointer to a buffer containing an array of null-terminated
strings that are merged into the message before Event Viewer displays the
string to the user.
So, I use the function in that way:
ReportEvent( hEventLog, //event log handler
EVENTLOG_INFORMATION_TYPE, //event type
CATEGORY_ONE, //SymbolicName of a category defined in .mc file
MSG_INFORMATION, //SymbolicName of the message definition defined in .mc file
userPSID, //current user's security identifier
1, //Number of strings to be logged
sizeData, //size of the binary data
logStr,//message shown in the event description.It is the data placed on %1
of the MSG_INFORMATION,
(LPVOID) BinaryData) //binary data
The logStr is provided by the application or by the application's .rc file,
so there is the possibility that the
app supplies the text to the event viewer. But does not this possibility
exist for the event category as well?