none
Writing to EventLog in VB.NET RRS feed

  • Question

  • Hi,

    I am writing items to a custom event log in VB.NET.

    I have successfully created my custom EventMessages.dll and I have managed to write certain events to the log.

    However, there are events which write to the log but are not being recognized as valid named events and I get the following error when I view the event in the Event Viewer.

    "the message resource is present but the message is not found in the string/message table"

    When I examine my .mc file which contains my message definitions (or more specifically, the accompanying header file) I find that the messages that are not displaying all have one thing in common - they have a severity code > 0. This means that the messages id value is > 65535.

    I think I have read somewhere that the message severity id along with the actual message id are bitwise ORed or something along those lines? Anyway the upshot is that I do not appear to be able to write messages with an id > 65535.

    Anyone come accross this before? Any pointers would be appreciated.

    Regards, 


    Justin Davenport

    VB2010

    Windows 7 x64

    Monday, June 25, 2012 9:15 AM

Answers

  • I have decided that the only way to write these events is probably using API calls or to tailor my event messages file to only have events with an id <= 65535. I will do the latter.

    Justin Davenport

    • Marked as answer by Soundbomber Monday, July 2, 2012 7:53 AM
    Monday, July 2, 2012 7:53 AM

All replies

  • This forum is for the System Base class, System object and its library related questions. 

    Your question is a daily question for the VB general forum.

    http://social.msdn.microsoft.com/Forums/en-US/vbgenera


    Success
    Cor

    Monday, June 25, 2012 5:07 PM
  • I am writing my event using
    System.Diagnostics.EventInstance



    Justin Davenport

    Tuesday, June 26, 2012 7:30 AM
  • Hi Sound,

    Welcome to the MSDN Forum.

    Would you like to post more related code about this issue?

    Anyway, how about this KB: http://msdn.microsoft.com/en-us/library/49dwckkz(v=vs.90).aspx 

    You can use the EventLog class to create a custom event log on a local or remote computer. You might create a custom log if you wanted to organize your entries in a more granular way than is allowed when your components write entries to the default Application log. For example, suppose you have a component called OrderEntry that writes entry information to an event log. You are interested in backing up and saving these entries for a longer period of time than some other entries in the Application log. Rather than registering your component to write to the Application log, you can create a custom log called OrdersLog and register your component to write entries to that log instead. That way, all of your order information is stored in one place and will not be affected if the entries in the Application log are cleared.

    You can indirectly use the CreateEventSource method to create a custom log. This method creates a new source and lets you specify the log to write to. If you specify that you want to write to a log that does not already exist, the system automatically creates a custom log for you and registers your component as a source for that log.

    And this one: http://support.microsoft.com/kb/307024 

    The code in this KB is c#, but you can try to translate it by this online tool: http://www.developerfusion.com/tools/convert/csharp-to-vb/ 

    I hope this will be helpful.

    Best regards,


    Mike Feng
    MSDN Community Support | Feedback to us
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Wednesday, June 27, 2012 8:43 AM
    Moderator
  • Hi Mike,

    I have tried the methods in the KB articles and always get refused access (UAC problem perhaps?) with errors such as the following:

    System.Security.SecurityException was caught
      Message=The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.
      Source=System
      StackTrace:
           at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly, Boolean wantToCreate)
           at System.Diagnostics.EventLog.SourceExists(String source, String machineName, Boolean wantToCreate)
           at System.Diagnostics.EventLog.SourceExists(String source)
           at fwCommonClasses.EventLog.WriteToEventLog(String Message, String ApplicationName, String LogType, EventLogEntryType EntryType) in C:\Development\2010\Common\fwCommonClasses\EventLog.vb:line 38
      InnerException: 
    


    Justin Davenport

    Wednesday, June 27, 2012 9:49 AM
  • Typically you need to create the event source as an administrator because info is written to the event log service registry hive.  Once created, you can then access it (write events) as a regular user.


    This signature unintentionally left blank.

    Wednesday, June 27, 2012 5:14 PM
  • OK so I can create my event source via the registry settings in my deployment project which is fine.

    I still cant write events with an id>65535 (&HFFFF) (Int16.MaxValue)


    Justin Davenport

    Thursday, June 28, 2012 7:43 AM
  • You need go to registry and remove all previous event source/log, then try again.
    Thursday, June 28, 2012 9:37 AM
  • The registry is fine.

    The events are being written fine.

    The event id in my event message .dll file (referenced in the registry) of the message I want to log has an id > 65535 - Not fine because I can't write (at least with System.Diagnostics.EventInstance) an event with an id > 65535!


    Justin Davenport

    Thursday, June 28, 2012 9:47 AM
  • Hi Justin,

    This is by design.

    Have a nice day.


    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    Friday, June 29, 2012 5:29 AM
  • Hi Ghost,

    Clearly it is by design, but this doesn't answer my question.


    Justin Davenport

    Friday, June 29, 2012 8:00 AM
  • Hi Justin,

    "This is by design" means there is no answer for you. So you need to report it connect site: http://connect.microsoft.com/VisualStudio/ 

    Have a nice day,


    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    Friday, June 29, 2012 9:54 AM
  • I have decided that the only way to write these events is probably using API calls or to tailor my event messages file to only have events with an id <= 65535. I will do the latter.

    Justin Davenport

    • Marked as answer by Soundbomber Monday, July 2, 2012 7:53 AM
    Monday, July 2, 2012 7:53 AM
  • OK, Good luck.

    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    Monday, July 2, 2012 8:39 AM