Event Log message missing

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • =?Utf-8?B?U3RldmVU?=
    #1

    Event Log message missing

    I have a small app which tries reading the system, application, and security
    event logs within Vista. Many of the event logs return with a generic
    sentance indicating that:

    "The description for Event ID '1073742825' in Source 'LoadPerf' cannot be
    found. The local computer may not have the necessary registry information or
    message DLL files to display the message, or you may not have permission to
    access them."

    The Event ID and Source differ from log to log but in all cases the
    reported Event ID in the message does not match the actual Event ID shown by
    Vista. Many times the Event ID within the message is a negative number.

    I don't have control over the "number" within the message. I believe the
    reason for this message appearing is because the "bad" Event ID in the
    message doesn't correspond to any valid Event ID that Vista understands. Has
    anyone seen this before?

    Here is a code snippet that shows the problem.

    EventLogPermiss ion elPermission = new
    EventLogPermiss ion(PermissionS tate.Unrestrict ed);
    System.Diagnost ics.EventLog eLog = new EventLog("Syste m", ".");
    EventLogEntryCo llection logs = eLog.Entries;
    foreach (EventLogEntry entry in logs)
    {
    Debug.WriteLine (entry.Message) ;
    }

    --
    -----------
    Thanks,
    Steve
    Tags: None
    • Willy Denoyette [MVP]
      #2
      Re: Event Log message missing

      "SteveT" <SteveT@newsgro ups.nospamwrote in message
      news:30E11848-B624-4F00-B31A-6EE4D2D1D412@mi crosoft.com...
      >I have a small app which tries reading the system, application, and
      >security
      event logs within Vista. Many of the event logs return with a generic
      sentance indicating that:
      >
      "The description for Event ID '1073742825' in Source 'LoadPerf' cannot be
      found. The local computer may not have the necessary registry information
      or
      message DLL files to display the message, or you may not have permission
      to
      access them."
      >
      The Event ID and Source differ from log to log but in all cases the
      reported Event ID in the message does not match the actual Event ID shown
      by
      Vista. Many times the Event ID within the message is a negative number.
      >
      I don't have control over the "number" within the message. I believe the
      reason for this message appearing is because the "bad" Event ID in the
      message doesn't correspond to any valid Event ID that Vista understands.
      Has
      anyone seen this before?
      >
      Here is a code snippet that shows the problem.
      >
      EventLogPermiss ion elPermission = new
      EventLogPermiss ion(PermissionS tate.Unrestrict ed);
      System.Diagnost ics.EventLog eLog = new EventLog("Syste m", ".");
      EventLogEntryCo llection logs = eLog.Entries;
      foreach (EventLogEntry entry in logs)
      {
      Debug.WriteLine (entry.Message) ;
      }
      >
      --
      -----------
      Thanks,
      Steve

      Vista uses a redesigned Eventlog system, you'll have to use the
      "System.Diagnos tics.Eventing.R eader" namespace classes to accurately
      read/manage Eventlog messages on Vista, this namespace is part of the
      upcoming Framework version 3.5.

      Willy.

        Comment

        • =?Utf-8?B?U3RldmVU?=
          #3
          Re: Event Log message missing

          I believe the .NET Framework 3.5 is in beta testing. Do you know whent the
          final version will be released?

          --
          -----------
          Thanks,
          Steve


          "Willy Denoyette [MVP]" wrote:
          "SteveT" <SteveT@newsgro ups.nospamwrote in message
          news:30E11848-B624-4F00-B31A-6EE4D2D1D412@mi crosoft.com...
          I have a small app which tries reading the system, application, and
          security
          event logs within Vista. Many of the event logs return with a generic
          sentance indicating that:

          "The description for Event ID '1073742825' in Source 'LoadPerf' cannot be
          found. The local computer may not have the necessary registry information
          or
          message DLL files to display the message, or you may not have permission
          to
          access them."

          The Event ID and Source differ from log to log but in all cases the
          reported Event ID in the message does not match the actual Event ID shown
          by
          Vista. Many times the Event ID within the message is a negative number.

          I don't have control over the "number" within the message. I believe the
          reason for this message appearing is because the "bad" Event ID in the
          message doesn't correspond to any valid Event ID that Vista understands.
          Has
          anyone seen this before?

          Here is a code snippet that shows the problem.

          EventLogPermiss ion elPermission = new
          EventLogPermiss ion(PermissionS tate.Unrestrict ed);
          System.Diagnost ics.EventLog eLog = new EventLog("Syste m", ".");
          EventLogEntryCo llection logs = eLog.Entries;
          foreach (EventLogEntry entry in logs)
          {
          Debug.WriteLine (entry.Message) ;
          }

          --
          -----------
          Thanks,
          Steve
          >
          >
          Vista uses a redesigned Eventlog system, you'll have to use the
          "System.Diagnos tics.Eventing.R eader" namespace classes to accurately
          read/manage Eventlog messages on Vista, this namespace is part of the
          upcoming Framework version 3.5.
          >
          Willy.
          >
          >

            Comment

            • =?Utf-8?B?U3RldmVU?=
              #4
              Re: Event Log message missing

              Does Orca Beta 1 contain this feature?
              --
              -----------
              Thanks,
              Steve


              "Willy Denoyette [MVP]" wrote:
              "SteveT" <SteveT@newsgro ups.nospamwrote in message
              news:30E11848-B624-4F00-B31A-6EE4D2D1D412@mi crosoft.com...
              I have a small app which tries reading the system, application, and
              security
              event logs within Vista. Many of the event logs return with a generic
              sentance indicating that:

              "The description for Event ID '1073742825' in Source 'LoadPerf' cannot be
              found. The local computer may not have the necessary registry information
              or
              message DLL files to display the message, or you may not have permission
              to
              access them."

              The Event ID and Source differ from log to log but in all cases the
              reported Event ID in the message does not match the actual Event ID shown
              by
              Vista. Many times the Event ID within the message is a negative number.

              I don't have control over the "number" within the message. I believe the
              reason for this message appearing is because the "bad" Event ID in the
              message doesn't correspond to any valid Event ID that Vista understands.
              Has
              anyone seen this before?

              Here is a code snippet that shows the problem.

              EventLogPermiss ion elPermission = new
              EventLogPermiss ion(PermissionS tate.Unrestrict ed);
              System.Diagnost ics.EventLog eLog = new EventLog("Syste m", ".");
              EventLogEntryCo llection logs = eLog.Entries;
              foreach (EventLogEntry entry in logs)
              {
              Debug.WriteLine (entry.Message) ;
              }

              --
              -----------
              Thanks,
              Steve
              >
              >
              Vista uses a redesigned Eventlog system, you'll have to use the
              "System.Diagnos tics.Eventing.R eader" namespace classes to accurately
              read/manage Eventlog messages on Vista, this namespace is part of the
              upcoming Framework version 3.5.
              >
              Willy.
              >
              >

                Comment

                • Willy Denoyette [MVP]
                  #5
                  Re: Event Log message missing

                  "SteveT" <SteveT@newsgro ups.nospamwrote in message
                  news:6ED3894D-CEE1-4155-ACDC-0CA4D2E18907@mi crosoft.com...
                  >I believe the .NET Framework 3.5 is in beta testing. Do you know whent the
                  final version will be released?
                  MS did not announce any release date yet, my best guess is beta 2 Q3 2007,
                  RTM Q1 2008.
                  Note that you don't have to wait for V3.5 if you *really* need to, you can
                  call into the "Windows Eventing" API's (wevtapi.dll) through PInvoke to
                  achieve your goal.

                  Willy.

                    Comment

                    • Ignacio Machin \( .NET/ C# MVP \)
                      #6
                      Re: Event Log message missing

                      Hi,
                      >
                      >
                      Vista uses a redesigned Eventlog system, you'll have to use the
                      "System.Diagnos tics.Eventing.R eader" namespace classes to accurately
                      read/manage Eventlog messages on Vista, this namespace is part of the
                      upcoming Framework version 3.5.
                      >
                      Willy.
                      So this mean that there is no way of reading events using the current 1.1 or
                      2.0 based code?



                        Comment

                        • Willy Denoyette [MVP]
                          #7
                          Re: Event Log message missing

                          "Ignacio Machin ( .NET/ C# MVP )" <machin TA laceupsolutions .comwrote in
                          message news:ei1aKmlwHH A.5108@TK2MSFTN GP03.phx.gbl...
                          Hi,
                          >
                          >>
                          >>
                          >Vista uses a redesigned Eventlog system, you'll have to use the
                          >"System.Diagno stics.Eventing. Reader" namespace classes to accurately
                          >read/manage Eventlog messages on Vista, this namespace is part of the
                          >upcoming Framework version 3.5.
                          >>
                          >Willy.
                          >
                          So this mean that there is no way of reading events using the current 1.1
                          or 2.0 based code?
                          >
                          >
                          >
                          Well, you can use System.Manageme nt for this.

                          ...
                          SelectQuery query = new SelectQuery("se lect * from Win32_NTLogEven t where
                          LogFile = 'System'");
                          using(Managemen tObjectSearcher searcher = new
                          ManagementObjec tSearcher(query ))
                          {
                          foreach (ManagementObje ct logMessage in searcher.Get()) {
                          Console.WriteLi ne("Eventcode: {0} - Description : {1} ",
                          logMessage["EventCode"], logMessage["Message"]);
                          }
                          }
                          ....
                          A second option is to "PInvoke" the Windows Eventing API's , or, you'll have
                          to live with the issue until 3.5 becomes available.
                          Note also that there should be no problem when reading your own logs, this
                          only applies to the System, Application and Security logs.

                          Willy.




                            Comment

                            • rob simon
                              #8
                              Re: Event Log message missing

                              How would you "PInvoke" the event API's for Vista? I have used the API
                              in C++ but I need to port this to VB and have had no luck so far.

                              Could you show me how to declare the functions in visual basic?

                              *** Sent via Developersdex http://www.developersdex.com ***

                                Comment

                                Previous template Next
                                Working...