“无法找到源Y中事件ID X的描述。”

Question

I'm trying to write custom events from my web application to the windows event log. I've had no luck getting the message strings to work, I keep getting "The description for Event ID X in Source Y cannot be found."

In trying to narrow this down I decided to write out an event to a source that already exists on my machine. I just looked at one of the events that was already written out, specifically SceCli event 1704.

I execute the following code:

var log = new EventLog("Application");
log.Source = "SceCli";

var ev = new EventInstance(1704, 0, EventLogEntryType.Information);
log.WriteEvent(ev);

However, this still gives me the following in Event Viewer:

The description for Event ID ( 1704 ) in Source ( SceCli ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: The event log file is corrupt..

I'm not sure what I'm missing here. I'm writing out the exact same event that already exists, and it still can't find the message string.

Answer 1

I also faced similar problem. After doing lot of research I did following I verified the steps according to this article http://www.codeproject.com/Articles/4166/Using-MC-exe-message-resources-and-the-NT-event-lo Everything seemed to be in place. Except one thing..i realised it when I stumbled on this msdn http://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx

As last paragraph says.. 'If the application calls RegisterEventSource and passes a source name that cannot be found in the registry, the event-logging service uses the Application log by default. However, because there are no message files, the Event Viewer cannot map any event identifiers or event categories to a description string, and will display an error. For this reason, you should add a unique event source to the registry for your application and specify a message file.' So my application name in RegisterEventSource was not matching with the application name in registry. I fixed this and now it works... So please double check your registry entries if you face this problem.

Answer 2

Can you see the other events properly? Most probably you are unable to use that particular source and event id (SceCli/1704) because the C# event class does not provide the right number of parameters to match the event template in the event message file. I think it will only work with sources that have just "%1" in their event message file (see http://www.eventid.net/show-DocId-22.htm for more details about that).

Anyway, I think you need to create a source for your custom application (if it doesn't exist) and then record the log entry. Before recording an event check if the source exists and create it if it doesn't:

if (!EventLog.SourceExists("MyWebApp"))
         EventLog.CreateEventSource("MyWebApp", "Application");
EventLog.WriteEntry("MyWebApp", "Some message", EventLogEntryType.Information, 1704);