Question

I have a requirement to modify a simple windows service written in win32 C (not c++).

Is there a library I can use to write event log entries to the windows event log without using eventcreate.exe? Or do I have to modify it to be compiled as a c++ program?

Answer 1

Yes, see the function ReportEvent and its example.

The event provider source file with .mc extension looks like this:

; // MyEventProvider.mc 
; // This is the header section.
   SeverityNames=(Success=0x0:STATUS_SEVERITY_SUCCESS
               Informational=0x1:STATUS_SEVERITY_INFORMATIONAL
               Warning=0x2:STATUS_SEVERITY_WARNING
               Error=0x3:STATUS_SEVERITY_ERROR
              )
   FacilityNames=(System=0x0:FACILITY_SYSTEM
               Runtime=0x2:FACILITY_RUNTIME
               Stubs=0x3:FACILITY_STUBS
               Io=0x4:FACILITY_IO_ERROR_CODE
              )
   LanguageNames=(English=0x409:MSG00409)
; // The following are the categories of events.
   MessageIdTypedef=WORD
   MessageId=0x1
   SymbolicName=NETWORK_CATEGORY
   Language=English
   Network Events
   ... rest of file omitted

The .mc file is compiled into a .res file which is linked into a .dll:

To compile the message text file, use the following command:

 mc -U provider.mc

To compile the resources that the message compiler generated, use the following command:

rc provider.rc

To create the resource-only DLL that contains the message table string resources, use the following command (you can run the command from a Visual Studio Command Prompt):

   link -dll -noentry provider.res

…