DLL version is 1.2.14.1 There is a "not found" message in every event description. The dll is registered automatically in windows registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SurfPolicy Sample: The description for Event ID ( 4096 ) in Source ( SurfPolicy ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: invalid query
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Gofer] "EventMessageFile"="NTEventLogAppender.dll" "CategoryMessageFile"="NTEventLogAppender.dll" "TypesSupported"=dword:00000007 "CategoryCount"=dword:00000008
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Gofer] + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SurfPolicy]
Committed in rev 487688 in log4j 1.2 branch, 487701 on trunk. There were several different issues involved. The NTEventLogAppender.dll did attempt to register itself to provide message resources for the event viewer, however it did not provide an absolute file path to the DLL and used the wrong key types. If the registry entries had been corrected, the previous DLL did not expose the MESSAGETABLE resource despite it being present in the link step. Combining the VERSION resource and the MESSAGETABLE resource into a single resource file before linking, fixed that problem. In addition, the category values used for the event logs were the int values of the level plus one, for example, a INFO message would have a category of 10001, WARN would be 20001, etc. This would cause the category string lookup to fail since the specs say that categories should start at 1 and be contiguous. In addition, the log4j 1.2 branch did not have bug 39437 applied which eliminated unnecessary conversion back to the local code page. The initial commits on the trunk in rev 487685 were misidentified as being related to bug 39437. The new DLL's should be compatible with earlier versions of log4j. When properly registered (by use, doesn't support regsvr32 at this time), existing events should have properly displayed messages, but the categories will still show the integer value of the level + 1.