HOWTO: How to Support Language-Independent Strings in Event Logging

ID: Q125661

The information in this article applies to:

Microsoft Win32 Application Programming Interface (API), used with:
- Microsoft Windows NT versions 3.1, 3.5, 3.51, 4.0
- Microsoft Windows 2000

SUMMARY

Insertion strings in the event log entries are language-independent. Instead of using string literals as the insertion string, use "%%n" as the insertion string.

MORE INFORMATION

When the event viewer sees "%%n", it looks up the ParameterMessageFile value in the registry, under the source of the event, as in this example:


   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      Security\ 
      ...

-or-


   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      System\ 
      Service Control Manager

It then calls the LoadLibrary() function of the ParameterMessageFile. Then it calls FormatMessage() using "n" as the ID.

For example, suppose an event log entry has the source

Service Control Manager

and the description is

Failed to start the service due to the following error: %%245.

In the registry, you find:


   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      System\ 
      Service Control Manager
         EventMessageFile...
         ParameterMessageFile REG_SZ  kernel32.dll
         TypesSupported...
         ...

Therefore, you need to follow these steps:

Use LoadLibrary() with KERNEL32.DLL.

Call FormatMessage() using the module handle obtained in step 1 and a string ID of 245.

Replace %%245 in the description with the string obtained in step 2.

Additional query words: 3.10 3.50

Keywords : kbEventLog kbKernBase kbWinOS2000 kbDSupport kbGrpKernBase
Version : winnt:3.1,3.5,3.51,4.0
Platform : winnt
Issue type : kbhowto