Click here to Skip to main content
15,867,771 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am learning how to use Windows event logging service.

MSDN:
RegisterEventSourceA function (winbase.h) - Win32 apps | Microsoft Docs[^]
Eventlog Key - Win32 apps | Microsoft Docs

C++
HANDLE RegisterEventSourceA(
  [in] LPCSTR lpUNCServerName,
  [in] LPCSTR lpSourceName
);

[in] lpSourceName

The name of the event source whose handle is to be retrieved. The source name must be a subkey of a log under the Eventlog registry key. Note that the Security log is for system use only.
Here, I am not clear if "a subkey" should be a direct subkey under the Eventlog or can be a nested one.

Let's assume "App1" is the event source name I will use from now on.
Below I see there happen to be three locations that "App1" is set:
HKEY_LOCAL_MACHINE
   SYSTEM
      CurrentControlSet
         Services
            Eventlog
               Application
                 AppName
               Security
               System
               App1
               MyCustLog
                 App1
               3rdPartyLog
                 App1
Now, in my program, I would call:
C++
HANDLE hEvtSrc = RegisterEventSource(0, "App1");
My question is: Among those 3 App1 subkeys, which App1 will be matched to return its handle to hEvtSrc?

What I have tried:

I am trying to figure out myself, but am lost.
Posted
Updated 14-Nov-21 21:55pm

1 solution

Quote:
Among those 3 App1 subkeys, which App1 will be matched to return its handle to hEvtSrc?
The first one under the Eventlog key will be the default. If you wish to access either of the others then you will need to use MyCustLog\App1 or 3rdPartyLog\App1 to specify the correct key.
 
Share this answer
 
Comments
ehaerim 15-Nov-21 10:06am    
Hi Richard,
Thanks for the quick answer.

I want to make sure one more time.
If I want to use the first one,
HANDLE hEvtSrc = RegisterEventSource(0, "App1");

If I want to use the second one,
HANDLE hEvtSrc = RegisterEventSource(0, "MyCustLog\\App1");

If I want to use the third one,
HANDLE hEvtSrc = RegisterEventSource(0, "3rdPartyLog\\App1");


Please confirm.
Richard MacCutchan 15-Nov-21 10:11am    
Why not just try it?
ehaerim 15-Nov-21 11:46am    
Hi Richard,
Unfortunately, it does not work that way. ReportEvent fails to find the event source such as "MyCustLog\\App1".
Could you check on you end please?
I appreciate it.
Richard MacCutchan 15-Nov-21 11:55am    
Look at the Event Viewer application in "Windows Administrative Tools" on your system. I think you will be able to see which categories are valid for this.
ehaerim 15-Nov-21 12:02pm    
I already did but that doesn't help me at all regarding this issue.
I would send you my source code project so that you can check it yourself.
Can you give me your email address or just write me an empty email to ehaerim@gmail.com. Then I will reply back to you with the code.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Top Experts
Last 24hrsThis month


CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900