April 29th, 2011, 09:41 AM
The source name in eventlog is different from source name in registry.
Hello everyone! I have a little question.
Everyone knows that field "Source" in EventLog Viewer, when you view logs, indicates the name of source. As far as I know the name of source is taken from eventlog entry. But at that time the source name is the name of registry key under the appropriate eventlog key.
For example, if we have custom eventlog "TestLog" it's key is HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\\TestLog and a custom provider "TestProvider" that writes events to that log with key HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\\TestLog\\TestProvider.
So, if TestProvider will write event in TestLog, the "Source" field in EventViewer will be "TestLog". And at last here is my question "If we take a look, for example, at HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application\\Microsoft-Windows-RestartManager provider and write some events to Application log we will see that "Source" field in EventViewer isn't "Microsoft-Windows-RestartManager" but "RestartManager". How can it be? That source name in eventlog is different from source name in registry?
May 4th, 2011, 04:01 AM
Re: The source name in eventlog is different from source name in registry.
The Name is taken from the file description (file properties) and not from the REG..
If you change the Description in your custom Service... you change the name in the Eventlog..
In the case that there is no description the Primary name will be used...
Articles VB6 : Break the 2G limit - Animation 1, 2 VB.NET : 2005/8 : Moving Images , Animation 1 , 2 , 3 , User Controls
WPF Articles : 3D Animation 1 , 2 , 3
Code snips: VB6 Hex Edit, IP Chat, Copy Prot., Crop, Zoom : .NET IP Chat (V4), Adv. ContextMenus, click Hotspot, Scroll Controls
Find me in ASP.NET., VB6., VB.NET , Writing Articles, My Genealogy, Forum
All VS.NET: posts refer to VS.NET 2008 (Pro) unless otherwise stated.
Tags for this Thread
Click Here to Expand Forum to Full Width