Recipe 16.3. Creating a New Event Log


Problem

You want to create a custom event log. This can be useful if you are developing an application or script that needs to write a bunch of events to the event log, and you do not want to clutter one of the default logs.

Solution

Using the Registry

To create a new event log, all you have to do is create a subkey under the Eventlog services key. Replace <LogName> with the name you want to give the event log:

Key: HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\Eventlog\ Subkey: <LogName>

Using VBScript
' This code creates a new event log.  ' ------ SCRIPT CONFIGURATION ------ strNewLog = "<LogName>"      ' e.g. MyLog strComputer = "<ComputerName>"   ' e.g. wks01 (use "." for local machine) ' ------ END CONFIGURATION --------- const HKLM = &H80000002 strKeyPath = "SYSTEM\CurrentControlSet\Services\EventLog\" & strNewLog set objReg = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv") objReg.CreateKey HKLM, strKeyPath WScript.Echo "Created Event log " & strNewLog

Discussion

When you view events in the event log using a tool such as Event Viewer, you are actually interacting with the Event Log service. It is this service that applications interface with to write and retrieve events in event logs.

Each event log is defined as a subkey under the HKLM\SYSTEM\CurrentControlSet\Services\Eventlog key. The name of the subkey is the name of the event log. The Event Log service constantly monitors this key for the creation of new subkeys. When it finds a new one, it creates a new event log. After it finds a new subkey, the Event Log service creates a file under the %SystemRoot%\System32\config directory to contain the event log messages. If you named the subkey Test, the file name would be Test.evt. You can then configure the new event log like you would one of the defaults (setting the maximum size, retention period, etc.).

See Also

MS KB 216169, "How to Change the Default Event Viewer Log File Location," and MS KB 315417, "HOW TO: Move Event Viewer Log Files to Another Location in Windows 2000"



Windows XP Cookbook
Windows XP Cookbook (Cookbooks)
ISBN: 0596007256
EAN: 2147483647
Year: 2006
Pages: 408

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net