Adding a Source to the Registry You can use the default Application log without adding an event source to the registry. However, Event Viewer will not be able to map your event identifier codes to message strings unless you register your event source and provide a message file. For more information, see Message Files. You can add a new source name to the registry by opening a new registry subkey under the Application key or a custom log using the RegCreateKeyEx function, and adding registry values to the new subkey using the RegSetValueEx function. The following example opens a new source and adds a message-file name and a bitmask of supported types. BOOL AddEventSource( LPTSTR pszLogName, // Application log or a custom log LPTSTR pszSrcName, // event source name LPTSTR pszMsgDLL, // path for message DLL DWORD dwNum) // number of categories { HKEY hk; DWORD dwData, dwDisp; TCHAR szBuf[MAX_PATH]; // Create the event source as a subkey of the log.
if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, szBuf, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hk, &dwDisp)) { printf("Could not create the registry key."); return FALSE; }
// Set the name of the message file.
if (RegSetValueEx(hk, // subkey handle "EventMessageFile", // value name 0, // must be zero REG_EXPAND_SZ, // value type (LPBYTE) pszMsgDLL, // pointer to value data (DWORD) (lstrlen(pszMsgDLL)+1)*sizeof(TCHAR))) // data size { printf("Could not set the event message file."); RegCloseKey(hk); return FALSE; }
if (RegSetValueEx(hk, // subkey handle "TypesSupported", // value name 0, // must be zero REG_DWORD, // value type (LPBYTE) &dwData, // pointer to value data sizeof(DWORD))) // length of value data { printf("Could not set the supported types."); RegCloseKey(hk); return FALSE; }
// Set the category message file and number of categories. if (RegSetValueEx(hk, // subkey handle "CategoryMessageFile", // value name 0, // must be zero REG_EXPAND_SZ, // value type (LPBYTE) pszMsgDLL, // pointer to value data (DWORD) (lstrlen(pszMsgDLL)+1)*sizeof(TCHAR))) // data size { printf("Could not set the category message file."); RegCloseKey(hk); return FALSE; }
if (RegSetValueEx(hk, // subkey handle "CategoryCount", // value name 0, // must be zero REG_DWORD, // value type (LPBYTE) &dwNum, // pointer to value data sizeof(DWORD))) // length of value data { printf("Could not set the category count."); RegCloseKey(hk); return FALSE; } RegCloseKey(hk); return TRUE; } Send comments about this topic to Microsoft
Adding a Source to the Registry
You can use the default Application log without adding an event source to the registry. However, Event Viewer will not be able to map your event identifier codes to message strings unless you register your event source and provide a message file. For more information, see Message Files.
You can add a new source name to the registry by opening a new registry subkey under the Application key or a custom log using the RegCreateKeyEx function, and adding registry values to the new subkey using the RegSetValueEx function. The following example opens a new source and adds a message-file name and a bitmask of supported types.
BOOL AddEventSource(
LPTSTR pszLogName, // Application log or a custom log
LPTSTR pszSrcName, // event source name
LPTSTR pszMsgDLL, // path for message DLL
DWORD dwNum) // number of categories
{
HKEY hk;
DWORD dwData, dwDisp;
TCHAR szBuf[MAX_PATH]; // Create the event source as a subkey of the log.
wsprintf(szBuf,
"SYSTEM\\CurrentControlSet\\Services\\EventLog\\%s\\%s",
pszLogName, pszSrcName);
if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, szBuf,
0, NULL, REG_OPTION_NON_VOLATILE,
KEY_WRITE, NULL, &hk, &dwDisp))
{
printf("Could not create the registry key.");
return FALSE;
}
// Set the name of the message file.
if (RegSetValueEx(hk, // subkey handle
"EventMessageFile", // value name
0, // must be zero
REG_EXPAND_SZ, // value type
(LPBYTE) pszMsgDLL, // pointer to value data
(DWORD) (lstrlen(pszMsgDLL)+1)*sizeof(TCHAR))) // data size
{
printf("Could not set the event message file.");
RegCloseKey(hk);
return FALSE;
}
// Set the supported event types.
dwData = EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE |
EVENTLOG_INFORMATION_TYPE;
if (RegSetValueEx(hk, // subkey handle
"TypesSupported", // value name
0, // must be zero
REG_DWORD, // value type
(LPBYTE) &dwData, // pointer to value data
sizeof(DWORD))) // length of value data
{
printf("Could not set the supported types.");
RegCloseKey(hk);
return FALSE;
}
// Set the category message file and number of categories. if (RegSetValueEx(hk, // subkey handle
"CategoryMessageFile", // value name
0, // must be zero
REG_EXPAND_SZ, // value type
(LPBYTE) pszMsgDLL, // pointer to value data
(DWORD) (lstrlen(pszMsgDLL)+1)*sizeof(TCHAR))) // data size
{
printf("Could not set the category message file.");
RegCloseKey(hk);
return FALSE;
}
if (RegSetValueEx(hk, // subkey handle
"CategoryCount", // value name
0, // must be zero
REG_DWORD, // value type
(LPBYTE) &dwNum, // pointer to value data
sizeof(DWORD))) // length of value data
{
printf("Could not set the category count.");
RegCloseKey(hk);
return FALSE;
} RegCloseKey(hk);
return TRUE;
}
Send comments about this topic to Microsoft