none
Eventlog.WriteEntry throws "Win32Exception / The parameter is incorrect" RRS feed

  • Question

  • //See if we need to truncate our buffer so we don't generate error while logging

      private const int MAX_ENTRY_SIZE = 32766;

    if (buffer1.Length > MAX_ENTRY_SIZE) { string buffer2 = buffer1.Substring(0, MAX_ENTRY_SIZE - 1); EventLog.WriteEntry(sourceName, buffer2 , type, this.EventId); } else { EventLog.WriteEntry(sourceName, buffer1, type, this.EventId); }

    What causes EventLog.WriteEntry to throw "Win32Exception / The parameter is incorrect".  The parameters all look correct to me.  

    Note, type is Error and EventId is 1.

    Here is the EventLogInternal code that is blowing up.  Appears to blow up on GCHandle.Alloc for some odd reason:

    IntPtr[] ptrArray = new IntPtr[strings.Length];
                GCHandle[] handleArray = new GCHandle[strings.Length];
                GCHandle handle = GCHandle.Alloc(ptrArray, GCHandleType.Pinned);
                try
                {
                    for (int j = 0; j < strings.Length; j++)
                    {
                        handleArray[j] = GCHandle.Alloc(strings[j], GCHandleType.Pinned);
                        ptrArray[j] = handleArray[j].AddrOfPinnedObject();
                    }
                    byte[] userSID = null;
                    if (!Microsoft.Win32.UnsafeNativeMethods.ReportEvent(this.writeHandle, (short) type, category, eventID, userSID, (short) strings.Length, rawData.Length, new HandleRef(this, handle.AddrOfPinnedObject()), rawData))
                    {
                        throw SharedUtils.CreateSafeWin32Exception();
                    }
                }
    I wonder if the EventLog has reserved characters.  The buffer has a bunch of web page content stuff related to HttpParseException.  What characters are allowed/disallowed?

    scott



    • Edited by scott_m Wednesday, October 8, 2014 11:19 PM
    Wednesday, October 8, 2014 10:59 PM

All replies

  • Hello scott_m,

    >> What causes EventLog.WriteEntry to throw "Win32Exception / The parameter is incorrect".  The parameters all look correct to me.

    The win32 exception is caused by the system method which we cannot not see it directly and being not sure the “The parameter is incorrect” is the exact error message, you could try below code to print the detail information:

    try {
    
                   System.Diagnostics.Process myProc = new System.Diagnostics.Process();
    
                   myProc.StartInfo.FileName = "c:\nonexist.exe";  //Attempting to start a non-existing executable
    
                   myProc.Start();    //Start the application and assign it to the process component.    
    
                }
    
                catch(Win32Exception w) {
    
                   Console.WriteLine(w.Message);
    
                   Console.WriteLine(w.ErrorCode.ToString());
    
                   Console.WriteLine(w.NativeErrorCode.ToString());
    
                   Console.WriteLine(w.StackTrace);
    
                   Console.WriteLine(w.Source);
    
                   Exception e=w.GetBaseException();
    
                   Console.WriteLine(e.Message);
    
                }
    

    >> What characters are allowed/disallowed?

    According this current method you are using, there is note we need to pay attention to:

    The message string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

    Please check if your message string contains these characters, my suggestion is that you could use bisection method to find all invalid characters in the message string if exists.

    Or it might be that this issue is caused by other parameters, please also try to provide a simple message string as “Hello” to check if it works or not so that this would help to narrow this issue.

    Regards,

    Fred.


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Thursday, October 9, 2014 8:02 AM
    Moderator
  • The buffer contains no % characters.

    Here is a sample of what the buffer contains (note, this is a property value from HttpParserExcpetion that is being logged):

    Results: System.CodeDom.Compiler.CompilerResults
    SourceCode: #pragma checksum "C:\Dev\TFS\CT\Trunk\ACME\Integrations\Capture\Web\Site.Master" "{ff1816ec-aa5e-4d10-87f7-6f4963833460}" "B709FB106202C4BB3ECCD1C98BF3FF9D356702D7"
    //------------------------------------------------------------------------------
    // <auto-generated>
    //     This code was generated by a tool.
    //     Runtime Version:4.0.30319.18449
    //
    //     Changes to this file may cause incorrect behavior and will be lost if
    //     the code is regenerated.
    // </auto-generated>
    //------------------------------------------------------------------------------

    namespace ASP {
        
        #line 11 "C:\Dev\TFS\CT\Trunk\ACME\Integrations\Capture\Web\Site.Master"
        using System.Web.UI.WebControls.Expressions;
        
        #line default
        #line hidden
        
        #line 329 "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config"
        using System.Collections;

    Thursday, October 9, 2014 2:53 PM
  • Hi scott_m,

    With your provided sample buffer, I could insert it to the event log successfully:

    Here is the simple test code:

    try
    
                {
    
                    string sSource;
    
                    string sLog;
    
                    string sEvent;
    
    
                    sSource = "dotNET Sample App";
    
                    sLog = "Application";
    
                    sEvent = File.ReadAllText("Sample2014110.txt");
    
    
                    if (!EventLog.SourceExists(sSource))
    
                        EventLog.CreateEventSource(sSource, sLog);
    
                    EventLog.WriteEntry(sSource, sEvent, EventLogEntryType.Error, 1);
    
                }
    
                catch (Exception)
    
                {
    
    
                    throw;
    
                }
    

    I am wondering if it is that when you try to insert the provided string to event log, it would throw the win32 exception. If it is, you could try my demo to see if it works for you.

    If not, could you please provided the whole string which would cause this win32 exception, you could save it to a txt file and upload it to skydrive so that we can download it and test it.

    Regards.

    Fred.


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Friday, October 10, 2014 6:16 AM
    Moderator