Windows:ReportEvent 函数

Question

据我了解，ReportEvent函数需要 Message Text Files通过注册表关联以接收格式正确的消息。是否有任何通用的事件 ID 或任何简单的方法来报告没有关联消息文本文件的事件？

或者，我可以在我的应用程序中使用特殊的通用事件源吗？像 RegisterEventSource(NULL, "Application") 这样的东西？

Answer 1

您不必在 HKLM 中注册您的消息。 (这是一件好事，因为如果您不是管理员，您不能注册消息)。

但这并不能阻止您将事件写入 Windows 应用程序事件日志。唯一的缺点是，从 Windows Vista 开始，您只会看到一些难看的文本。

HRESULT LogToEventLog(String Source, String EventText, int EventType, DWORD EventID)
{
   /*
      EventType is one of:
         EVENTLOG_ERROR_TYPE       = $0001;
         EVENTLOG_WARNING_TYPE     = $0002;
         EVENTLOG_INFORMATION_TYPE = $0004;
         EVENTLOG_AUDIT_SUCCESS    = $0008;
         EVENTLOG_AUDIT_FAILURE    = $0010;

      Source is your name for your app or feature, e.g.:
         "My Cool App"
         "Outlook"    
         "ESENT"
         "Chrome"
   */

   HANDLE h = RegisterEventSource(null, Source); //null --> local computer
   if (h == 0) 
      return HResultFromWin32(GetLastError);
   try
   {       
      PChar[1] ss;
      ss[0] = PChar(EventText);

      if (!ReportEvent(
            h,         // event log handle
            EventType, // event type
            0,         // category zero
            EventID,   // event identifier
            null,      // no user security identifier
            1,         // one substitution string
            0,         // no data
            @ss,       // pointer to string array
            null       // pointer to data
      ))
      {
         return HResultFromWin32(GetLastError);
      }
   }
   finally
   {
      DeregisterEventSource(h);
   }
   return S_OK;
}

现在您可以将事件记录到应用程序事件日志中:

LogToEventLog("Stackoverflow", "Question 5399066 was answered by Ian Boyd", 
      EVENTLOG_INFORMATION_TYPE, 0x45);

窃取别人的注册信息

不幸的是，从 Windows Vista 开始，Windows 会提示您没有事先注册该事件:

The description for Event ID 69 from source Stackoverflow cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Question 5399066 was answered by Ian Boyd

但您不必忍受它。仅仅因为您没有在 HKLM 中注册消息源文件，并不意味着没有其他人注册过。

例如，请注意事件日志中来自 Outlook 源的消息:

• 来源:Outlook
• 事件 ID:0x40000020
• 事件数据:D:\win32app\Exchange\Outlook2003.pst
• 消息:商店 D:\win32app\Exchange\Outlook2003.pst 已检测到目录检查点。

您可以在以下位置查看 Outlook 的注册信息:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Outlook

然后看:

MessageEventFile: REG_SZ = "D:\Programs\MICROS~4\Office14\1033\MAPIR.DLL"

如果您查看 MAPIR.dll 二进制文件的资源，您会看到它的消息表:

1 MESSAGETABLE
{
0x12,       "Connection stats for server (%1).  Rpcs Attempted (%2), Rpcs Succeeded (%3), Rpcs Failed (%4), Rpcs Canceled (%5), Rpc UI shown (%6), Avg request time (%7) ms, Min request time (%8) ms, Max request time (%9) ms.\r\n"
0x14,       "Cancelable RPC started.\r\n"
0x15,       "Cancelable RPC shutdown.\r\n"
0x40000010,     "Cancelable RPC dialog shown for server (%1), total wait time was (%2) ms, result was (%3).\r\n"
0x40000011,     "User canceled request against server (%1) after waiting (%2) ms.\r\n"
0x40000013,     "Rpc call (%1) on transport (%2) to server (%3) failed with error code (%4) after waiting (%5) ms; eeInfo (%6).\r\n"
0x40000016,     "There was a problem reading one or more of your reminders. Some reminders may not appear.\r\n"
0x40000017,     "Unable to update public free/busy data.\r\n"
0x4000001A,     "%1\r\n"
0x4000001B,     "%1\r\n"
0x4000001D,     "The store %1 is being re-pushed to the indexer for the following reason: %2.\r\n"
0x4000001E,     "Starting reconciliation for the store %1 for the following reason: %2.\r\n"
0x4000001F,     "The store %1 has detected a catalog rebuild.\r\n"
0x40000020,     "The store %1 has detected a catalog checkpoint.\r\n"
...
}

可以看到eventid 0x40000020关联了一个格式化字符串:

"The store %1 has detected a catalog checkpoint.\r\n"

你可以劫持 Outlook 的注册:

LogToEventLog("Outlook", "Your mom", EVENTLOG_INFORMATION_TYPE, $40000020);

你会把你的事件添加到事件日志中，而没有所有丑陋的警告: