Eventlogs - AutoItEventMsg.dll

[ChrisL]

I've created a Event Messages dll which keeps custom application eventlogs clear of garbage.

Typically event logs created in autoit Have a long message before actually getting to the point, this is the Eventvwr trying to read the message file dll.

Using the attahced DLL and include file you can create nice clean events with the name of your application.

AutoItEventMsg.zip

#include "_CustomEventLog.au3"

$MyEventName = "AutoIt"

$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")

If NOT @error then 
    _RegisterEvent($EventLog, $SUCCESS, $App_Started, @ScriptName)
    _RegisterEvent($EventLog, $INFORMATION, $App_OK, "Just confirming this app is OK")
    _RegisterEvent($EventLog, $ERROR, $App_Error, "This app is not feeling very well" & @crlf & "Can someone call a doctor")
    _RegisterEvent($EventLog, $WARNING, $App_Warning, "There is no crap in this event log")
    _RegisterEvent($EventLog, $INFORMATION, $App_Information, "Nothing to see here")
    _RegisterEvent($EventLog, $INFORMATION, $App_Free, "This is my Free string" & @crlf & "with nothing at the begining")
    _RegisterEvent($EventLog, $SUCCESS, $App_Stopped, @ScriptName)
EndIf

;or using the normal AutoIt includes

$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")

Global $aData[1]=[0]
$hEventLog = _EventLog__RegisterSource("",$EventLog)
_EventLog__Report($hEventLog, $INFORMATION, "None", $App_Information, "","Another message without the crap", $aData)
_EventLog__Close ($hEventLog)

Edit: Added some more examples

Edit2: Updated the Dll with version info and other stuff!

Edited June 13, 2008 by ChrisL

[arcker]

Excellent IDEA !!

will use this on my server !!

really good IDEA and initiative

[Valuater]

Cool!!!

8)

[James]

So this cleans up the event log only?

[ChrisL]

So this cleans up the event log only?

If you create an application and you want to use the event log you can include this dll, then when the eventlog entry is created it knows to look at the dll for the error codess I specified plus your string of data. Then you don't get the long message about event viewer could not locate the dll yada yada yada

[perlabsrat]

If you create an application and you want to use the event log you can include this dll, then when the eventlog entry is created it knows to look at the dll for the error codess I specified plus your string of data. Then you don't get the long message about event viewer could not locate the dll yada yada yada

First off great work, its just what I needed...

I do have 2 questions.

1. I am in a lab and this event logger is going to be a part of some tools so I can log when events happen when each of the tools run.

I am installing/copying my exe and your dll to a directory "C:\scripts". This install process is started via a bat file on a usb key (kickoff.bat) so the current path is the key when I run kickoff.bat.

I modified my exe to read from $CmdLineRaw - One of the first things I do right after I copy the logger is run a command like:

call c:\scripts\eventlogger.exe tools install started

The problem is that it seems that because the current directory path is on the key at run time of kickoff.bat I have to change my current directory from the key to c:\scripts and then call the logger or nothing will be written to the event log. I have done this using pushd and popd but I was courious as to why the bat file needs the current dir to be where the exe and dll are located.

Also just to try it, I attempted to run regsvr32.exe against the dll but it said it "AutoITEventMSG.dll was loaded, but the DLL Registerserver entry point was not found. This file can not be registerd"

Can you or anyone explain why the current dir needs to be changed for the event to fire correctly?

2. Is there any way to have this code log the same event in both the system and application log. Because of the work we are doing us I need a way to place markers in the event logs at key moments so I can see all that happens in both logs. Having the event duplicated will help to better troubleshoot issues for us.

Thanks.

[ChrisL]

First off great work, its just what I needed...

I do have 2 questions.

1. I am in a lab and this event logger is going to be a part of some tools so I can log when events happen when each of the tools run.

I am installing/copying my exe and your dll to a directory "C:\scripts". This install process is started via a bat file on a usb key (kickoff.bat) so the current path is the key when I run kickoff.bat.

I modified my exe to read from $CmdLineRaw - One of the first things I do right after I copy the logger is run a command like:

call c:\scripts\eventlogger.exe tools install started

The problem is that it seems that because the current directory path is on the key at run time of kickoff.bat I have to change my current directory from the key to c:\scripts and then call the logger or nothing will be written to the event log. I have done this using pushd and popd but I was courious as to why the bat file needs the current dir to be where the exe and dll are located.

Also just to try it, I attempted to run regsvr32.exe against the dll but it said it "AutoITEventMSG.dll was loaded, but the DLL Registerserver entry point was not found. This file can not be registerd"

Can you or anyone explain why the current dir needs to be changed for the event to fire correctly?

2. Is there any way to have this code log the same event in both the system and application log. Because of the work we are doing us I need a way to place markers in the event logs at key moments so I can see all that happens in both logs. Having the event duplicated will help to better troubleshoot issues for us.

Thanks.

Sorry I've only just seen this.

First

$MyEventName = "AutoIt"

$EventLog = _SetLog($MyEventName,"c:\scripts\AutoIteventmsg.dll")

Should register the dll for the application to use c:\scripts\AutoIteventmsg.dll

Without the code I can't really comment.

You cant register the dll with regserver, it's not that type of dll, it has no COM objects.

2. I think the easiest way is you would need to duplicate my 2 functions but change it to the system log not application

[lowray1975]

Hello Chris,

I have two questions although before I get to those I would like to say thank you for writing the DLL for our use!

First, do you know if the DLL works properly in Vista and 2008 Server?

Second, would you be willing to share the source code? I'm worried that if I put this into mass production that in the future it may not work with a new version of MS Windows and having the source code would allow me to update in the future.

Thoughts?

Thanks again!

- Josh

Edited August 10, 2009 by lowray1975

[bap]

Hello Chris,

First of all thank you for sharing your work. Very helpful!

Is there any chance that you would share the code for the library (AutoIteventmsg.dll)?

Bap

I've created a Event Messages dll which keeps custom application eventlogs clear of garbage.

Typically event logs created in autoit Have a long message before actually getting to the point, this is the Eventvwr trying to read the message file dll.

Using the attahced DLL and include file you can create nice clean events with the name of your application.

AutoItEventMsg.zip

#include "_CustomEventLog.au3"

$MyEventName = "AutoIt"

$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")

If NOT @error then 
    _RegisterEvent($EventLog, $SUCCESS, $App_Started, @ScriptName)
    _RegisterEvent($EventLog, $INFORMATION, $App_OK, "Just confirming this app is OK")
    _RegisterEvent($EventLog, $ERROR, $App_Error, "This app is not feeling very well" & @crlf & "Can someone call a doctor")
    _RegisterEvent($EventLog, $WARNING, $App_Warning, "There is no crap in this event log")
    _RegisterEvent($EventLog, $INFORMATION, $App_Information, "Nothing to see here")
    _RegisterEvent($EventLog, $INFORMATION, $App_Free, "This is my Free string" & @crlf & "with nothing at the begining")
    _RegisterEvent($EventLog, $SUCCESS, $App_Stopped, @ScriptName)
EndIf

;or using the normal AutoIt includes

$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")

Global $aData[1]=[0]
$hEventLog = _EventLog__RegisterSource("",$EventLog)
_EventLog__Report($hEventLog, $INFORMATION, "None", $App_Information, "","Another message without the crap", $aData)
_EventLog__Close ($hEventLog)

Edit: Added some more examples

Edit2: Updated the Dll with version info and other stuff!

[memnon]

really nice, i love this little script

i have only one question - is it possible to set the Eventid itself, too? (i get all events marked with Eventid 3)

[ChrisL]

really nice, i love this little script

i have only one question - is it possible to set the Eventid itself, too? (i get all events marked with Eventid 3)

Bit of a late reply.

I'd created ID's 1 to 8.

Global Const $App_Started = 0x1
Global Const $App_Stopped = 0x2
Global Const $App_OK = 0x3
Global Const $App_Warning = 0x4
Global Const $App_Error = 0x5
Global Const $App_Information = 0x6
Global Const $App_Free = 0x7
Global Const $App_Fatal_Error = 0x8

[doudou]

Thx for this, Chris. I usually juggle with the message compiler which somewhat over-dimensioned for a quick scripting job, Your solution is perfect for this purpose.

[pboom]

Thanks Chris for sharing this. It works great. I added the following to your documentation though it may help someone else;

#cs
These contants are also defined in the Custom DLL
The DLL then provides the text to the event entry added to your text as listed below

Global Const $App_Started = 0x1            -> Suffix started.
Global Const $App_Stopped = 0x2            -> Suffix stopped.
Global Const $App_OK = 0x3                -> Prefix OK:
Global Const $App_Warning = 0x4            -> Prefix WARNING:
Global Const $App_Error = 0x5            -> Prefix ERROR:
Global Const $App_Information = 0x6        -> Prefix INFORMATION:
Global Const $App_Free = 0x7            -> NO prefix or Suffix provided by DLL
#ce

 

 

Edited May 26, 2015 by pboom
Add comments declarations

[timmy2]

Thank you for creating this, ChrisL, but I tried using your example script in Windows 8.1 64b and every event still has the "crap".  Any suggestions?

 

expandcollapse popup

#cs ----------------------------------------------------------------------------

 AutoIt Version: 3.2.12.0
 Author:         Chris Lambert (ChrisL)

 Script Function:
    Template AutoIt script.

#ce ----------------------------------------------------------------------------

; Script Start - Add your code below here

#include "_CustomEventLog.au3"

#cs

Global Const $App_Started = 0x1
Global Const $App_Stopped = 0x2
Global Const $App_OK = 0x3
Global Const $App_Warning = 0x4
Global Const $App_Error = 0x5
Global Const $App_Information = 0x6
Global Const $App_Free = 0x7
#ce



$MyEventName = "AutoIt"

$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")
If NOT @error then 
    _RegisterEvent($EventLog, $SUCCESS, $App_Started, @ScriptName)
    _RegisterEvent($EventLog, $INFORMATION, $App_OK, "Just confirming this app is OK")
    _RegisterEvent($EventLog, $ERROR, $App_Error, "This app is not feeling very well" & @crlf & "Can someone call a doctor")
    _RegisterEvent($EventLog, $WARNING, $App_Warning, "There is no crap in this event log")
    _RegisterEvent($EventLog, $INFORMATION, $App_Information, "Nothing to see here")
    _RegisterEvent($EventLog, $INFORMATION, $App_Free, "This is my Free string" & @crlf & "with nothing at the begining")
    _RegisterEvent($EventLog, $SUCCESS, $App_Stopped, @ScriptName)
EndIf







;or using the normal AutoIt includes

#include "_CustomEventLog.au3"
$MyEventName = "AutoIt"
$EventLog = _SetLog($MyEventName,"AutoIteventmsg.dll")

If Not @Error then 
    Global $aData[1]=[0]
    $hEventLog = _EventLog__RegisterSource("", $MyEventName)
    _EventLog__Report($hEventLog, $INFORMATION, "None", $App_Warning, "","Another message without the crap", $aData)
    _EventLog__Close ($hEventLog)
EndIf

 

[argumentum]

Thank you for creating this, ChrisL, but I tried using your example script in Windows 8.1 64b and every event still has the "crap".  Any suggestions?

yep, you've got to run as an admin as to be able to write to the registry and change this:

Func _SetLog($vName,$dll)
    Local $vAppKey
    $dll = _PathFull($dll)
    If NOT FileExists($dll) then Return SetError(1,0,-1)
    Local $sHKLM = "HKLM64"
    If @OSArch = "X86" Then $sHKLM = "HKLM"
    $vAppKey = Regread($sHKLM&"\SYSTEM\CurrentControlSet\Services\EventLog\Application\" &  $vName , "EventMessageFile")
    If $vAppKey <> $dll then
        RegWrite($sHKLM&"\SYSTEM\CurrentControlSet\Services\EventLog\Application\" & $vName, "EventMessageFile", "REG_EXPAND_SZ",$dll)
        RegWrite($sHKLM&"\SYSTEM\CurrentControlSet\Services\EventLog\Application\" & $vName, "TypeSupported", "REG_DWORD",31)
        Return $vName
    Else
        Return $vName
    EndIf
EndFunc

You should be good then.