EventLog control

[Larry Waibel]

I'm using the EventLog component in my configuration. I wanted to limit the
logs to 64K and have them overwrite as needed. In the Target Designer in the
EventLog component Registry Data, I changed the entries. But when I build
and deploy and look at the registry entries on the target system they aren't
what I set them to in the component. How do I control the EventLog without
having the EventLog viewer on the target (including it bumps my usage from
60MB to 160MB and I can't afford that). Thanks!

 

[KM]

Larry,

I'm using the EventLog component in my configuration. I wanted to limit
the
logs to 64K and have them overwrite as needed. In the Target Designer in
the
EventLog component Registry Data, I changed the entries. But when I build
and deploy and look at the registry entries on the target system they
aren't

Are those getting overwritten at build time or during FBA? (open pre-FBA
image system hive and explore the settings under EventLog key)

what I set them to in the component. How do I control the EventLog
without
having the EventLog viewer on the target (including it bumps my usage from
60MB to 160MB and I can't afford that).

Just add "Event Log" component and it will bring in the event logging
functionality. Don't add the heavy "Administration Support Tools" which
includes the Event Viewer (the exe).

KM

 

[Larry Waibel]

How do I "open pre-FBA image system hive and explore the settings under
EventLog key"?

 

[Larry Waibel]

Okay, I figured out how to load the hive from my XP build and look at it with
regedit. The values in there are as I set them in TD which is what I want.
So something is happening later to change them. There's an entry toward the
end of the FBA log that says 'replacing system hives' but that's about all I
see. How do I determine what's changing the values?

 

[KM]

Larry,

Okay, I figured out how to load the hive from my XP build and look at it
with
regedit.
Good.

The values in there are as I set them in TD which is what I want.

Perfect. Now we know that it is some component that changes the values
during FBA.

So something is happening later to change them. There's an entry toward
the
end of the FBA log that says 'replacing system hives' but that's about all
I see.

This is required FBA step and it is not relevant to the issue.

How do I determine what's changing the values?

That may be hard to find out. At least very labourous. You can put some
generic FBA commands to call CMD at diffenret FBA phases. The FBA should
wait until you close CMD window. In CMD you call to regedit and check out
the reg.value. This way you would know at what FBA phase the value gets
changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
key to see what FBA command is run at that phase.

Another way could be in creating a reg.monitoring app that would be launched
early to watch on when values are changed at particular registry branch and
log the changes. This way you again know when the value was changed.

It may be just easier to change the reg.values at the end of FBA (either
through very late FBA command or through StartUp item if you have Explorer
Shell).

KM

 

[Larry Waibel]

I'd hoped it would have been easier to find than that Guess since I have
an application that starts up each boot I'll just have it set the registry
values. I just hate not knowing what's going on!

From: "KM" <konstmor@nospam_yahoo.com>
Subject: Re: EventLog control
Date: Thu, 26 May 2005 11:59:15 -0700
Newsgroups: microsoft.public.windowsxp.embedded

Larry,

Okay, I figured out how to load the hive from my XP build and look at it
with
regedit.
Good.

The values in there are as I set them in TD which is what I want.

Perfect. Now we know that it is some component that changes the values
during FBA.

So something is happening later to change them. There's an entry toward
the
end of the FBA log that says 'replacing system hives' but that's about all
I see.

This is required FBA step and it is not relevant to the issue.

How do I determine what's changing the values?

That may be hard to find out. At least very labourous. You can put some
generic FBA commands to call CMD at diffenret FBA phases. The FBA should
wait until you close CMD window. In CMD you call to regedit and check out
the reg.value. This way you would know at what FBA phase the value gets
changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
key to see what FBA command is run at that phase.

Another way could be in creating a reg.monitoring app that would be launched
early to watch on when values are changed at particular registry branch and
log the changes. This way you again know when the value was changed.

It may be just easier to change the reg.values at the end of FBA (either
through very late FBA command or through StartUp item if you have Explorer
Shell).

KM

 

[Slobodan Brcin \(eMVP\)]

Larry,

Please read this post:
http://groups-beta.google.com/group.../6a1597586bcb4e13?hl=en&lr=&ie=UTF-8&c2coff=1

Regards,
Slobodan

I'd hoped it would have been easier to find than that Guess since I have
an application that starts up each boot I'll just have it set the registry
values. I just hate not knowing what's going on!

From: "KM" <konstmor@nospam_yahoo.com>
Subject: Re: EventLog control
Date: Thu, 26 May 2005 11:59:15 -0700
Newsgroups: microsoft.public.windowsxp.embedded

Larry,

Okay, I figured out how to load the hive from my XP build and look at it
with
regedit.
Good.

The values in there are as I set them in TD which is what I want.

Perfect. Now we know that it is some component that changes the values
during FBA.

So something is happening later to change them. There's an entry toward
the
end of the FBA log that says 'replacing system hives' but that's about all
I see.

This is required FBA step and it is not relevant to the issue.

How do I determine what's changing the values?

That may be hard to find out. At least very labourous. You can put some
generic FBA commands to call CMD at diffenret FBA phases. The FBA should
wait until you close CMD window. In CMD you call to regedit and check out
the reg.value. This way you would know at what FBA phase the value gets
changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
key to see what FBA command is run at that phase.

Another way could be in creating a reg.monitoring app that would be launched
early to watch on when values are changed at particular registry branch and
log the changes. This way you again know when the value was changed.

It may be just easier to change the reg.values at the end of FBA (either
through very late FBA command or through StartUp item if you have Explorer
Shell).

KM

From: "KM" <konstmor@nospam_yahoo.com>
Subject: Re: EventLog control
Date: Wed, 25 May 2005 21:52:36 -0700
Newsgroups: microsoft.public.windowsxp.embedded

Larry,

I'm using the EventLog component in my configuration. I wanted to
limit
the
logs to 64K and have them overwrite as needed. In the Target Designer
in
the
EventLog component Registry Data, I changed the entries. But when I
build
and deploy and look at the registry entries on the target system they
aren't

Are those getting overwritten at build time or during FBA? (open pre-FBA
image system hive and explore the settings under EventLog key)

what I set them to in the component. How do I control the EventLog
without
having the EventLog viewer on the target (including it bumps my usage
from
60MB to 160MB and I can't afford that).

Just add "Event Log" component and it will bring in the event logging
functionality. Don't add the heavy "Administration Support Tools" which
includes the Event Viewer (the exe).

KM