How to create NTEventlogAppender.dll as required for logging event in the eventlog using log4cplus

Question

First, Let me thank for the log4cplus source code.

I am facing one issue as follows:

What I am trying to do? I want to log the messages to event log on windows.

What did I do? I could get the event logging enabled by in including following .h

          #include <log4cplus/nteventlogappender.h>

And creating the appender as follows:

          SharedAppenderPtr append_3(new NTEventLogAppender(LOG4CPLUS_TEXT("127.0.0.1"), LOG4CPLUS_TEXT("log"), LOG4CPLUS_TEXT("source")));
          append_3->setName(LOG4CPLUS_TEXT("ToEventlog"));

          Logger to_eventlog = Logger::getInstance(LOG4CPLUS_TEXT("to_eventlog"));
          to_eventlog.addAppender(append_3);
          to_eventlog.setLogLevel(log4cplus::ALL_LOG_LEVEL);

And logging as

         Logger to_eventlog = Logger::getInstance(LOG4CPLUS_TEXT("to_eventlog"));
         LOG4CPLUS_FATAL(to_eventlog, “Test Message.”);

When I log the message, I get following in the event log:

---

The description for Event ID 4096 from source source cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Test Message.

the message resource is present but the message is not found in the string/message table

---

I tried to create a dll with name NTEventLogAppender.dll with string table resource and a string with id 4096 (as hardcoded in the nteventlogappender.cxx file in log4cplus) and compiled it with resource only dll (/NOENTRY) but I still keep getting above error.

I already tried question to log4cplus-devel@lists.sourceforge.net but did not get any answer yet.

Any help on how to create this dll would be greatly appreciated.

Thanks.

Answer 1

This is how I resolved this issue:

comipiled NTEventLogAppender.mc file using commands:

mc -U NTEventLogAppender.mc
rc -r NTEventLogAppender.rc
link -dll -noentry -out:NTEventLogAppender.dll NTEventLogAppender.res

where NTEventLogAppender.mc has following contents

---

MessageIdTypedef=DWORD

SeverityNames=(Success=0x0:STATUS_SEVERITY_SUCCESS
Informational=0x1:STATUS_SEVERITY_INFORMATIONAL
Warning=0x2:STATUS_SEVERITY_WARNING
Error=0x3:STATUS_SEVERITY_ERROR
)


FacilityNames=(System=0x0:FACILITY_SYSTEM
Runtime=0x2:FACILITY_RUNTIME
Stubs=0x3:FACILITY_STUBS
Io=0x4:FACILITY_IO_ERROR_CODE
)

LanguageNames=(English=0x409:MSG00409)

; // The following are message definitions.

MessageId=0x1000
SymbolicName=SVC_TEST
Language=English
A message for something.
.

; // A message file must end with a period on its own line
; // followed by a blank line.

---

copied the NTEventLogAppender.dll to c:\windows\system32 and ran the above mentioned test program and found that event log found the message resource correctly.

you need to register this dll by copying following in .reg file and running the same

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\log\source]
"EventMessageFile"="C:\\windows\\system32\\NTEventLogAppender.dll"
"CategoryMessageFile"="C:\\windows\\system32\\NTEventLogAppender.dll"
"TypesSupported"=dword:00000007
"CategoryCount"=dword:00000005

---