How to Support Language-Independent Strings in Event Logging

ID: Q125661

3.10 3.50 3.51 4.00 WINDOWS NT kbprg

The information in this article applies to:

SUMMARY

Insertion strings in the event log entries are language-independent. Instead of using string literals as the insertion string, use "%%n" as the insertion string.

MORE INFORMATION

When the event viewer sees "%%n", it looks up the ParameterMessageFile value in the registry, under the source of the event, as in this example:

   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      Security\ 
      ...

   -or-

   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      System\ 
      Service Control Manager

It then calls the LoadLibrary() function of the ParameterMessageFile. Then it calls FormatMessage() using "n" as the ID.

For example, suppose an event log entry has the source "Service Control Manager" and the description is "Failed to start the service due to the following error: %%245."

In the registry, you find:

   HKEY_LOCAL_MACHINE\SYSTEM\ 
      CurrentControlSet\ 
      Services\ 
      EventLog\ 
      System\ 
      Service Control Manager
         EventMessageFile...
         ParameterMessageFile REG_SZ  kernel32.dll
         TypesSupported...
         ...

Therefore, you need to follow these steps:

1. Use LoadLibrary() with KERNEL32.DLL.

2. Call FormatMessage() using the module handle obtained in step 1 and a

   string ID of 245.

3. Replace %%245 in the description with the string obtained in step 2.

Additional reference words: 3.10 3.50 3.51 4.00 KBCategory: kbprg KBSubcategory: BseMisc

Keywords          : kbnokeyword kbKernBase kbGrpKernBase 
Version           : 3.10 3.50 3.51 4.00
Platform          : NT WINDOWS

Last Reviewed: December 18, 1996