LogParser - Error

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

vsr - 18 Jan 2006 23:05 GMT

I am reading the Event Log from application , its working fine when connects
to local coputers event log but giving the following message instead of the
actual error message when connecting to remote server's event log
-------------------------
"The description for Event ID in Source cannot be found. The local computer
may not have the necessary registry information or message DLL files to
display messages from a remote computer"

Reply to this Message

Richard Grimes [MVP] - 27 Jan 2006 19:29 GMT

> I am reading the Event Log from application , its working fine when
> connects to local coputers event log but giving the following message
[quoted text clipped - 3 lines]
> computer may not have the necessary registry information or message
> DLL files to display messages from a remote computer"

The EventLog class in 1.0 and 1.1 is braindead. Microsoft belatedly
noticed their mistake and tried to correct it in 2.0 but the damage has
already been done.

The event log needs this information:

- the name of the event source, this gives a registry key that has the
resource file (usually a resource only DLL)
- the ID of a format string in the resource file
- the strings that are used to replace placeholders in the format string

Note that the formatted message is NOT stored in the eventlog, the
message is formatted by the event log viewer which will load the
resource file, obtain the format string and insert the strings in the
placeholders (see FormatMessage).

The problem is that the designers of EventLog decided not to treat the
event log in the way that it was designed to be used. IMO they just
ported the code from VB6 because that language also had this horrible
way of reporting events. In their great wisdom the .NET designers
decided that event messages should be formatted *when they are reported*
rather than *when they are read* (which is the way that the event log is
designed to work). Square peg, round hole; broken implementation.

OK rant over; I have to have this rant every now and again because the
EventLog class is such a dumb implementation. (Its an indication that
Microsoft does not do code reviews).

Your error is generated because the remote machine does not have the
event source registered on it. It's not a .NET problem. On the remote
machine open:

HKLM\System\CurrentControlSet\EventLog\Application

Create a key with the name of the source then under that create a string
value called EventMessageFile and give it the full path to the
EventLogMessages.dll file on the local machine, eg:

C:\WINDOWS\Microsoft.NET\Framework\<version>\EventLogMessages.dll

If you do not have the .NET framework on the remote machine then you can
copy this file from a machine that does have the framework. That would
solve the problem, but I don't know if it is allowed under the EULA. If
not, you can create your own version of this file by filling it with
65,000 format strings that just have the single placeholder %1. (Yes, I
said it was a dumb implementation).

Richard

Signature

Fusion Tutorial: http://www.grimes.demon.co.uk/workshops/fusionWS.htm
Security Tutorial:
http://www.grimes.demon.co.uk/workshops/securityWS.htm

Reply to this Message

vsr - 27 Jan 2006 20:01 GMT

Thank you very much , i am trying with this , but what it means by "Source"
in the following?

> Create a key with the name of the source then under that create a string
> value called EventMessageFile and give it the full path to the

Is it the source of the application that generates error? or name of the
application that reads the Event Log.?

> > I am reading the Event Log from application , its working fine when
> > connects to local coputers event log but giving the following message
[quoted text clipped - 52 lines]
>
> Richard

Reply to this Message

LogParser - Error

Free Magazines