Hi Jimmy,
Thanks for the reply. Which IDs are talking about? I am actually unable to
get description for all the events. The Event IDs are more or less the same
as used in downlevel clients. For example, The event id 1025.
I had read in some site that the Event Log architecture has changed. Is this
creating problems? I am using the simple SDK Event Logging Functions like,
OpenEventLog, CloseEventLog, ReadEventLog, etc for enumerating the Event on
the Vista Machine. This works fine. But the logic for fetching the
description is failing. As mentioned in the previous posts I am trying to
read the description from the EventMessageFile available through the
registry. I tried to look into the EventMessageFile resource directly using
a resource hacker tool. I could not find any message table (string table)
resource in that dll from where I am trying to fetch the format strings.
This is why the logic is failing.
So now, I am just curious as how Vista is storing the event descriptions.
For example, check out the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET
Runtime. In this you'll find a string value
EventMessageFile="C:\Windows\system32\mscoree.dll". Ideally this dll should
have all the resource strings related to the events for the ".NET Runtime"
related events. But in Vista this does not have those resources.
Can you please confirm that Vista does not store the resource strings
anymore in the EventMessageFile? Also, it would be great if you let me know
how could I get these resource strings on Vista.
Thanks & Regards,
Vineet Kumar Das
"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
news:650EAAA0-F5B3-40A2-A774-3A323007AAAC@microsoft.com...
> Sorry, another user had a similar problem and I couldn't figure it out
> either. The only information I found relating to the error was in the KB
> article I posted about.
>
> However, I did just yesterday find out that MS re-numbered the event log
> ID's in Vista, and that these numbers are bigger than the old event log
> could display. This seems to me like it might cause problems, but I don't
> know for sure. I will see if I can get clarification.
>
> Just out of curiosity ... are all the ID's that downlevel clients won't
> display bigger than the ID's that it can?
>
> - JB
>
> Vista Support FAQ
> http://www.jimmah.com/vista/