Chapter 6 -- Event Logging

[Previous] [Next]

Chapter 6

When a typical software application needs to make the user aware of some special situation, it commonly uses visual or audio feedback. Most software is given the luxury of this type of event reporting, because the software can make an important assumption: when it is running, a human is sitting in front of the computer. Most server software, however, can't make such an assumption.

Therefore, server developers use files or some other similar persistent storage to maintain a log of events reported by their software. The system administrator can then routinely view the log file and keep tabs on important events and errors. This solves the problem of not having a person sitting at the machine at all times, but it introduces a new problem: manageability. What system administrator is going to enjoy using a dozen different server applications that report events in a dozen different formats in files stored in a dozen different places on the system? And this scenario doesn't even consider events reported by the operating system itself.

Microsoft Windows addresses this manageability issue by introducing a standard event reporting mechanism: the Event Log service. The Event Log service enforces a standard logging format and makes it easy to view logs by using a single event viewer application that provides one-stop shopping for the system administrator. Windows uses the Event Log service to report system events such as low hard disk space and failed logon attempts. Of course, your server software is not required to take advantage of event logging, but your users will appreciate consistency with the other server software they use as well as consistency with the actual system.

In this chapter, we'll learn about the event log and how to write software that reports events. This includes learning how to compile and utilize message files associated with events. Event reporting is all that most application developers care about, and the Event Viewer snap-in is usually all that any administrator will need to read events, but we'll also cover how to design an application to read an event log.

So let's take a moment to explore event logging, first from the administrator's perspective, and then from the operating system's perspective.