Why are events no longer logged after service receives SERVICE_CONTROL_SHUTDOWN?

[ahmd]

It took me a while to figure this one out. After my service receives SERVICE_CONTROL_SHUTDOWN notification all events that I try to log into the Windows Event Log with RegisterEventSource(), ReportEvent() APIs never get logged. Any idea why and how to enable it?

[Igor Vartanov]

As to me, the most probable reason is after that Event Log itself gets shut. System shutdown does not guarantee even writing to file, though you could still try that.

[ahmd]

Yes, it looks like the event logging service simply shuts down as soon as SERVICE_CONTROL_SHUTDOWN notification is sent out. I was just trying to find any official documentation that would elaborate this... But, too bad... because that is exactly the moment when logging is required...

As for plain old CreateFile/WriteFile APIs, luckily they continue to function up until the very end. Think about it, if they stopped working there's really nothing that your service needs to do. Pretty much most of everything you do boils down to saving to a persistent storage on a low level. So not allowing it would equal to just terminating every process, wouldn't it?

[Igor Vartanov]

So not allowing it would equal to just terminating every process, wouldn't it?

It will depend on how long it would take to write. System shutdown cannot wait endlessly, and at some point have to kill everybody still alive, just to let file system drivers shut nice.

[ahmd]

It will depend on how long it would take to write. System shutdown cannot wait endlessly, and at some point have to kill everybody still alive, just to let file system drivers shut nice.

Come on, Igor, it takes milliseconds to write. I'm not copying gigabyte files at shutdown...

[Arjay]

Try SERVICE_CONTROL_PRESHUTDOWN

[ahmd]

Try SERVICE_CONTROL_PRESHUTDOWN

The code has to work on XP as well.

[Arjay]

The code has to work on XP as well.

Code it for both. Put your hack in for XP and use PreShutdown for newer OS's.

That way, when you quit supporting XP the hacked code goes away.

[ahmd]

Code it for both. Put your hack in for XP and use PreShutdown for newer OS's.

That way, when you quit supporting XP the hacked code goes away.

Good point. Thank you.

My only concern though, is it true that events will be logged from that pre-shut-down notification? Have you, or anyone else, tried it? Because I don't want to start changing it only to learn that it doesn't work there either...

[Arjay]

Good point. Thank you.

My only concern though, is it true that events will be logged from that pre-shut-down notification? Have you, or anyone else, tried it? Because I don't want to start changing it only to learn that it doesn't work there either...

Based on the PreShutdown event description in Msdn (in your link above), it should work. You'll have to try it out, though.

[Igor Vartanov]

I don't want to start changing it only to learn that it doesn't work there either...

You never need to change your main project. What you need is to build a small service and fully log its behavior while shutdown proceeds. This would take you one hour (maybe two) to get all the answers that you need.