NT Service Event Messages. Where do they go?
-
I've developed an NT Service and implemented event messages that are logged as application messages. The message compiler builds the .RC file and the .BIN file for me. The .RC file is compiled into the .RES file for the service. After I install and run the service, however when I look into the event log, I discover that while the differents events have been logged, the message assoicated with them is not available as part of the 'Details' of the event. I suspect that the .BIN file has to go somewhere, but I don't where. Anybody have a thought of what to look at? Thanks. Chris
-
I've developed an NT Service and implemented event messages that are logged as application messages. The message compiler builds the .RC file and the .BIN file for me. The .RC file is compiled into the .RES file for the service. After I install and run the service, however when I look into the event log, I discover that while the differents events have been logged, the message assoicated with them is not available as part of the 'Details' of the event. I suspect that the .BIN file has to go somewhere, but I don't where. Anybody have a thought of what to look at? Thanks. Chris
You need to create an registry entry with the appname you use in the call to register the message. HKEY_CURRENT_MACHINE(?)\SYSTEM\CurrentControlSet\Services \Eventlog\Application\myprog (i think) The myprog subkey will contain several entries, one of which is the path to the file containing the resource format strings associated with the messages you are writing. In your case, this would be your service, but it could also be (and often is) a separate resource DLL. When you invoke details on a message in the event viewer, it looks in the myprog key and tries to find the resource file specified so it can format the message for view. There's an article on "EventLog Service Entries" in the MDSN that helps a bit - check the other reg entries to get an idea of what is needed.
-
I've developed an NT Service and implemented event messages that are logged as application messages. The message compiler builds the .RC file and the .BIN file for me. The .RC file is compiled into the .RES file for the service. After I install and run the service, however when I look into the event log, I discover that while the differents events have been logged, the message assoicated with them is not available as part of the 'Details' of the event. I suspect that the .BIN file has to go somewhere, but I don't where. Anybody have a thought of what to look at? Thanks. Chris
The .BIN and .RC file from the message compiler end up being produced in the project directory. The need to be there so the resource compiler can find them. However after the service is installed, for some reason the event viewer, needs to find the .BIN file in the same directory as where the service has been registered. Once a put a copy there, all works fine. I've added a post build command to copy the .BIN files to the appropriate directory and I can forget all about it. HTH somebody else! Chris
-
I've developed an NT Service and implemented event messages that are logged as application messages. The message compiler builds the .RC file and the .BIN file for me. The .RC file is compiled into the .RES file for the service. After I install and run the service, however when I look into the event log, I discover that while the differents events have been logged, the message assoicated with them is not available as part of the 'Details' of the event. I suspect that the .BIN file has to go somewhere, but I don't where. Anybody have a thought of what to look at? Thanks. Chris
I've found, that putting the binary messages into a dummy DLL works fine. All you do is create a dummy DLL, edit the Registry key for EventLog\Application to point at your DLL and it should work. Just a suggestion. Matthias p.s.: I'm currently writing a simple tutorial "A total idiots guide to the Event Log". I will be posting it till the end of the week. So if you are patient enough...