This project has moved and is read-only. For the latest updates, please go here.

Customizing ESE logging with JET_paramEventSourceKey

Jul 23, 2013 at 9:13 PM
This is partially a repeat of this question here: http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/0cd97413-d255-4710-a6a7-e9b6d4865048/esent-jetsetsystemparameter-jetparameventsourcekey-how-to-configure-registry-key

Basically, it looks like JET_paramEventSourceKey (aka JET_param.EventSourceKey, InstanceParameters.EventSourceKey) customizes both the Windows Event Log it goes to (e.g. Application, Security, System, MyCustomLog) as well as the Event Log Source (by default ESENT).
For instance, without all the other registry setup, if I explicitly set JET_paramEventSourceKey to "Application" (since that seems close to the default, even though an empty string is the default), I get this for the "new instance started" message in the Application log:
The description for Event ID 102 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

<InstanceName (JET_paramEventSource's value)>
6432
<InstanceName>:
0
6
01
7601
0000

the message resource is present but the message is not found in the string/message table
(As implied by the message, the "Source" is "Application" rather than "ESENT")
Is there a way to force the two settings to be distinct? Looking at other "Applications and Services Logs" on my machine (namely "Windows PowerShell" with a source of "PowerShell"), it doesn't seem like it's a limitation with the regular event logging API, but I've never used the API so I don't know for certain. And while that's true, for future work, I don't want to limit our custom log to just have ESE events, and I also don't want the ESE events to be given the "better" name over our own events.

Windows 7 SP1, 64bit (for both 32 and 64bit processes).
Jul 23, 2013 at 10:00 PM
And I just realized that the name of the parameter really is "EventSourceKey", so of course it only overrides the event source, but miraculously overrides the log in some cases, too?
So I guess now the question is "is there a way to override the event log without changing the event source?" Just changing the event source may be good enough, I mainly just wanted the logs related to our projects out of the way by default (and then using a custom view to merge the two logs together if that was necessary).
Aug 6, 2013 at 8:03 PM
Sorry, it does not look like there's a way to set them independently, but to be honest I couldn't easily find which Win32 API determines the Source -- It's not RegisterEventSource() -- that's Application/System/etc.; and ReportEvent() doesn't have an szSource parameter.

Event logging always seems to be much more complicated than it needs to be...

-martin
Sep 10, 2013 at 7:19 PM
Oops, sorry for the delay in getting back to you. Thanks for looking into it, your findings confirm what mine (particularly the 'much more complicated' comment :). I was hoping that since you had a larger body of code actually using it, you'd be able to see something that I couldn't. Oh well.

and now I'm resurrecting a long dead thread, but I feel bad not replying :)

Thanks again.