Where can I find a good example of using the ReportEvent function?

Question

As with most "obsolete" MSDN pages, the ReportEvent page contains too little information for me to fully understand. I tried searching, but can't find a good, clean, simple example of using a function. Can anyone suggest it?

Answer 1

I ended up using this:

HANDLE eventLog; WORD type; const char* msg; // ... snip ... ReportEvent(eventLog, type, 0, 1, NULL, 1, 0, &LPCTSTR(msg), NULL); 

It seems to work quite well.

Answer 2

Well, it looks like this is a very old thread that landed here to find a good Report Event example ... but realized you didn't get any answers ... and probably already found a solution.

The reason you see “Event ID not found” is because EventViewer cannot load / search the text resource that will be displayed for the event ID. Sorry if the last line sounded geeky .. but this is what I understand EventLog:

-EventLogging has two aspects

• Register with EventLog (or in other words, create an EventSource)
• Record or write to the event log
• View or read from a magazine

When you register in the event log, you simply specify eventSource (any name that identifies this log) + EventMessageFile, category file and supported item types. Here, EventMessageFile points to a DLL / EXE that contains message descriptions / resources.

When you register an event, you simply register it using some data, such as EventID, category ID and EventData. But when you view it using any EventViewer (or Windows eventVwr.exe), the viewer reads your events, looks for the DLL / EXE associated with your eventSource (specified by EventMessageFile), and displays the decription from the resource section of this DLL / EXE.

This DLL is nothing more than a simple resource file that has been compiled using MessageCompiler and contains a "MessageTable". This is to ensure the registration of cultural events.

This is the reason. When you export a log to XML / TXT, etc. from his EventViewer, he asks you if you want to save it “with display information” or “without display information” so that you can view it on computers that do not have EventMessageFile.

JFYI registry entry is located at:

 HKLM\CurrentControlSet\System\Services\EventLog\Application 

one catch: if you are interested in how .NET does this ... it just does this by providing an EventMessageFile named EventLogMessage.dll (found under %SYSTEMROOT%\Microsoft.Net\Framework\vXXXX\ ) by %SYSTEMROOT%\Microsoft.Net\Framework\vXXXX\

Answer 3

As I recall, it hurts to set up correctly - you need to add messages to the application using the Message Compiler - if you miss this, you will not see useful message codes. Take a look at Creating a Windows NT Service Using ATL for an example

Answer 4

Sample Windows Service C ++ is a Windows service informing the event log, you can get the code from https://code.msdn.microsoft.com/windowsapps/CppWindowsService-cacf4948 in particular, the following function (specified from ServiceBase.cpp) does this is

 // // FUNCTION: CServiceBase::WriteEventLogEntry(PWSTR, WORD) // // PURPOSE: Log a message to the Application event log. // // PARAMETERS: // * pszMessage - string message to be logged. // * wType - the type of event to be logged. The parameter can be one of // the following values. // // EVENTLOG_SUCCESS // EVENTLOG_AUDIT_FAILURE // EVENTLOG_AUDIT_SUCCESS // EVENTLOG_ERROR_TYPE // EVENTLOG_INFORMATION_TYPE // EVENTLOG_WARNING_TYPE // void CServiceBase::WriteEventLogEntry(PWSTR pszMessage, WORD wType) { HANDLE hEventSource = NULL; LPCWSTR lpszStrings[2] = { NULL, NULL }; hEventSource = RegisterEventSource(NULL, m_name); if (hEventSource) { lpszStrings[0] = m_name; lpszStrings[1] = pszMessage; ReportEvent(hEventSource, // Event log handle wType, // Event type 0, // Event category 0, // Event identifier NULL, // No security identifier 2, // Size of lpszStrings array 0, // No binary data lpszStrings, // Array of strings NULL // No binary data ); DeregisterEventSource(hEventSource); } }