Write log description

[DC Gringo]

I have some code that writes log entries upon errors in an VB.NET web app.

I can write the Message but in the log, preceding my message is the
following:

Description:
The description for Event ID ( 0 ) in Source ( Application ) cannot be
found. The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: <MY
MESSAGE SHOWS UP HERE>


How can I get rid of this and/or add the Event ID as suggested? Here's my
code

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load

Dim MissingPageErrorMsg As String
MissingPageErrorMsg = "A user has attempted to visit a non-existent page:
" & Request.QueryString("aspxerrorpath")
WriteToEventLog("Application", MissingPageErrorMsg)

End Sub


Sub WriteToEventLog(ByVal LogName As String, ByVal Message As String)
'Create event log if it doesn't exist
If (Not EventLog.SourceExists("Application")) Then
EventLog.CreateEventSource("Application", "Application")
End If
' Write to application event log
Dim Log As New EventLog("Application")
Log.Source = LogName
Log.WriteEntry(Message, EventLogEntryType.Error)
End Sub

 

[Michael]

The whole mechanism of writing events to the log is rather involved
and can be complex depending on how detailed you want to get with your
messaging. I will give a brief overview of what I recently learned
and implemented but a good explanation of all the details can be found
here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/about_event_logging.asp

When you write a message to the Windows EventLog, the system looks in
the registry to see if a message resource file has been associated
with the Application Name you specify.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\{your
application name}

In your application you call the following

If (Not EventLog.SourceExists("Application")) Then
EventLog.CreateEventSource("Application", "Application")
End If

which checks to see if the following registry key exists and creates
it if not:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application

The documentation I've read says that you don't really need to create
the EventSource because a call to WriteEvent will create the source if
it doesn't already exist. However, to use predefined messages you
definitely need to create the event source in the registry manually
first.

Under this registry key there needs to be several values:

1. EventMessageFile - REG_EXPAND_SZ string value specifying the path
to a message resource dll (I'll discuss that file in a moment)

2. TypesSupported - REG_DWORD value using bit masks to indicate
whether your message file handles Information, Warning, Error,
AuditSuccess, and/or AuditFailure messages.

3. CategoryMessageFile - optional REG_EXPAND_SZ string value
specifying the path to a category resource dll. This could be the same
file as the EventMessageFile or a separate file.

4. CategoryCount - optional REG_DWORD value specifying how many
Category types have been specified in the Category resource dll.


The message resource dll is created by compiling a text file through
the mc command line executable. This generates a resource file with an
rc extension. This file then needs to be resource compiled with the rc
command line executable resulting in a resource dll that you can use
for the registry entry above.

The text file specifies the message text associated with each Event ID
(or error code). A message file declaration looks something like
this:

--------------------
MessageIdTypedef=DWORD

SeverityNames=(Success=0x0:STATUS_SEVERITY_SUCCESS
Information=0x1:STATUS_SEVERITY_INFORMATION
Warning=0x2:STATUS_SEVERITY_WARNING
Error=0x3:STATUS_SEVERITY_ERROR
)

MessageId=0x03EF
Severity=Error
SymbolicName=MSG_ERROR
Language=English
A user has attempted to visit a non-existent page
..
--------------------

Note that the Severity value specified for a MessageID sets the high
order bits of the resulting Event ID. In other words, the message
declared above results in an Event ID of 0xC00003EF. You must pass in
this error code to get a match.

The message text you declare in the text file can have insert values
as well, specified by %n where n is 1 through 99. The message string
you pass into the call to write to the event log is used as the insert
value. If you pass in a string with embedded chr$(0), each substring
is used as a separate insert value.

--------------------
MessageId=0x03EF
Severity=Information
SymbolicName=ERR_MSG_MISSING_PAGE
Language=English
A user has attempted to visit a non-existent page: %1
..
--------------------

You would then change your code to something like this

Public Const ERR_MSG_MISSING_PAGE = &HC00003EF

Private Sub Page_Load(ByVal sender As System.Object, _
ByVal e As System.EventArgs) _
Handles MyBase.Load

{...some code that loads the page...}

If {...some test that load failed...} Then
WriteToEventLog("MyApplication", ERR_MSG_MISSING_PAGE, _
Request.QueryString("aspxerrorpath"))
End If

End Sub

Sub WriteToEventLog(ByVal SourceName As String, _
ByVal EventID as Integer, _
ByVal Message As String)
'Create event log if it doesn't exist
If (Not EventLog.SourceExists(SourceName)) Then
EventLog.CreateEventSource(SourceName, "Application")
End If

'Write to application event log
Dim Log As New EventLog("Application")
Log.Source = SourceName
Log.WriteEntry(Message, EventLogEntryType.Error, EventID)
End Sub

HTH,
Michael Levy