FIX: Problems with IoWriteErrorLogEntry Writing Error Messages

The information in this article applies to:

• Microsoft Win32 Device Development Kit (DDK) version 3.5

SYMPTOMS

When writing some types of error messages to the event log via IoWriteErrorLogEntry, the event description may be missing. The warning and error severity messages display the following when viewed in the event log:

   The description for Event ID (##) in Source (DRIVER_NAME) could not
   be found.  It contains the following insertion string(s): .

Here is the severity information from NTSTATUS.H:

//
//  Values are 32 bit values layed out as follows:
//
//   3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
//   1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
//  +---+-+-+-----------------------+-------------------------------+
//  |Sev|C|R|     Facility          |               Code            |
//  +---+-+-+-----------------------+-------------------------------+
//
//  where
//
//      Sev - is the severity code
//
//          00 - Success
//          01 - Informational
//          10 - Warning
//          11 - Error
//
//      C - is the Customer code flag
//
//      R - is a reserved bit
//
//      Facility - is the facility code
//
//      Code - is the facility's status code

CAUSE

There is a problem in the FormatMessage() API call that is preventing negative error codes from working correctly. Negative error codes are those that indicate warning and error severity; that is, bit 31 of the error code is set.

RESOLUTION

As a temporary workaround, a device driver writer can modify the defined error messages to ensure that bit 31 of the error code is not set.

STATUS

Microsoft has confirmed this to be a bug in Windows NT version 3.5. This bug was corrected in Windows NT version 3.51.