in reply to [fixed] Write to Win32 Event Log, get "/AUXSOURCE=" error

Report() takes a hash. It should contain the following keys:

  1. Computer: identifies the computer. Can be null for the local computer.
  2. Source: Identifies the application.

    This string is not just a text identifier, but also a key in the registry: 

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Applicat
+ion\"source".

    [download]

    This is used to associate a compiled resource (a .dll) with the event source (application) that contains a RT_MESSAGETABLE of strings.

    Those strings are identified by an integer ids (EventID), and can contain substitution placeholders (%1, %2 etc).

  3. EventType (INFO | WARNING | ERROR | AUDIT SUCCESS |AUDIT FAILURE).
  4. Category: An application define numeric value.
  5. EventID: The message number within the message table.
  6. Data: Some raw binary data associated with the event.
  7. Strings: A buffer of 0 or more null-terminated strings that will be substituted for the placeholders embedded within the message text identified by EventID retrieved from the message table located in the resouce dll pointed at in the registry by the source parameter.

The error message is telling you that the "source" identifier cannot be located within the registry. Hence, the text associated with the EventID (which you aren't supplying!) cannot be retrieved. Therefore the string you supply cannot be substituted into it.

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.
"Too many [] have been sedated by an oppressive environment of political correctness and risk aversion."

Replies are listed 'Best First'.
Re^2: Write to Win32 Event Log, get "/AUXSOURCE=" error
by wilsond (Scribe) on Jan 21, 2009 at 06:01 UTC

    Awesome. This sounds quite right, though I haven't tested it yet, about to do it now. This is exactly the input I needed. Thanks, you rock.


    While I ask a lot of Win32 questions, I hate Windows with a passion. That's the problem with writing a cross-platform program. I'm a Linux user myself. I wish more people were.
    If you want to do evil, science provides the most powerful weapons to do evil; but equally, if you want to do good, science puts into your hands the most powerful tools to do so.
    - Richard Dawkins
[reply]

      I don't want to use it, but in case it helps anyone, I found that in XP (and probably newer Windows versions), there is a binary in SYSTEM32 called eventcreate.exe that will write to the EventLog with a custom source name without the same error I've been getting. This is an example usage: eventcreate /ID 1 /L APPLICATION /SO MyAppName /T INFORMATION /D "This is a test entry in the EventLog."

      And extending on the idea of using eventcreate.exe, you can use it in a different way: using it as the source of your EventLog messages in the registry. Here is what works for me (import into registry after modifying your app name:

      Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Applica
+tion\MyAppName]
"EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52
+,00,6f,\
  00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00
+,32,00,\
  5c,00,45,00,76,00,65,00,6e,00,74,00,43,00,72,00,65,00,61,00,74,00,65
+,00,2e,\
  00,65,00,78,00,65,00,00,00
"TypesSupported"=dword:00000007
"CustomSource"=dword:00000001

      [download]

      While I ask a lot of Win32 questions, I hate Windows with a passion. That's the problem with writing a cross-platform program. I'm a Linux user myself. I wish more people were.
      If you want to do evil, science provides the most powerful weapons to do evil; but equally, if you want to do good, science puts into your hands the most powerful tools to do so.
      - Richard Dawkins
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom