Use Windows NT Event Logging

Event logging in Microsoft Windows NT provides a standard, centralized way for applications and the operating system to record important software and hardware events. It also provides a standard user interface for viewing the logs and a programming interface for examining the logs. Event logging provides a means to merge events from various sources into a single informative story.

The event log functions allow three kinds of event reports to be generated:

• Information: You have something to report that does not require any interaction from the user or administrator, but could help in any future troubleshooting.
• Warning: Your component had a problem but was able to recover. These messages are invaluable in troubleshooting.
• Error: Your component had a problem and most likely was unable to recover. This type of error usually needs user intervention to correct the problem.

Remember the audience - administrators and users who are trying to troubleshoot the problem.

A message should contain:

• All the information needed to interpret what caused the problem.
• What to do to correct the problem.

This may seem like basic advice, but many error messages are cryptic. For example, avoid a message like the following:

A driver packet received from the I/O subsystem was invalid. 
The data is the packet. 

What this message means is that the driver in question is functioning properly, but is logging incorrectly formatted packets in the event log. To correct the problem, a Unicode version of the driver is needed.

When you start to write your message, you should consider the following:

• Is the information useful to the user, administrator, and product support staff?
• If it is debug information, do not include it in the retail product.
• Do not use tabs or commas in the message text. Event log files can be saved as comma or tab separated text files. Many organizations import these files into databases and the extra formatting characters require manual manipulation.