EventLog.WriteEntry Method (String)

Question

Hi,

I'm writing a class in C# that uses the EventLog.WriteEntry method.

The documentation says that the message size can be 32766 bytes long.

But when i write a message of 32766 byte, i get a Win32Exception.

I then tried reducing the message size to see how long it could be.

31592 bytes was the maximum.

I'm running Windows 7 Ultimate, 32 bit. Version 6.1 (Build 7600)

Answer 1

Hello Oddmar,

 

Thanks for posting! :-) I can reproduce the issue. I look into the documentation of EventLog.WriteEntry
http://msdn.microsoft.com/en-us/library/xzwc042w.aspx
It indicates when the message string is longer than 32766 bytes, there will be an ArgumentException. We can also know this if we look into Refelected codes. So 32766 is limited and detected from .NET layer, not the Win32 layer.
-------------------------------------------------------------------------------------------------
private void InternalWriteEvent(uint eventID, ushort category, EventLogEntryType type, string[] strings, byte[] rawData, string currentMachineName)
{
    if (strings == null)
    {
        strings = new string[0];
    }
    if (strings.Length >= 0x100)
    {
        throw new ArgumentException(SR.GetString("TooManyReplacementStrings"));
    }
    for (int i = 0; i < strings.Length; i++)
    {
        if (strings[i] == null)
        {
            strings[i] = string.Empty;
        }
        if (strings[i].Length > 0x7ffe)
        {
            throw new ArgumentException(SR.GetString("LogEntryTooLong"));
        }
    }
    ....
    ....
        if (!UnsafeNativeMethods.ReportEvent(this.writeHandle, (short) type, category, eventID, userSID, (short) strings.Length, rawData.Length, new HandleRef(this, handle.AddrOfPinnedObject()), rawData))
        {
            throw SharedUtils.CreateSafeWin32Exception();
        }
    ....
    ....
-------------------------------------------------------------------------------------------------

Based on your test, the limitation should be 31592 bytes from the Win32 layer. The reflected codes also tells us the EventLog.WriteEntry eventually calls into native Windows API ReportEvent,
http://msdn.microsoft.com/en-us/library/aa363679(VS.85).aspx

That documentation indicates there is a 31893 limitation and it also says "The ReportEvent function adds the time, the entry's length, and the offsets before storing the entry in the log." So, I believe that may be the reason why Win32 only accepts message less then 31592 based on your test.

Have a nice day!

 

 

Ji Zhou

MSDN Subscriber Support in Forum

If you have any feedback on our support, please contact [e-mail]

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 2

Does my last reply addresses your concern? If you need any future help, just let me know!

Have a nice day!

 

 

Ji Zhou

MSDN Subscriber Support in Forum

If you have any feedback on our support, please contact [e-mail]

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 3

Hi Ji, 

What i did, was just shorten the message to 32766 bytes.

But i dont understand why the documented size works fine on Windows XP and 2003 OS ?

Isn't it a bug in Win7 ?

Regards

Oddmar

MCP