RE: NTEventLogAppender with missing description source for Windows Server 2003

[CHANG Shuh <sh...@gemalto.com>]

Hi Emilie,

Thanks for your inquiry. Please keep all inquiries on the log4j-user
list.

No, I have not heard much back to resolve this issue. I am hoping that
someone who knows the answer could help out. 

Basically, the NTEventLogAppender works to capture the log information
in the Event Viewer, except that it also generates those extra annoying
messages for every log that you send. These extra messages clog up (and
probably mislead) the real log message that makes the NTEventLogAppender
somewhat unrealistic for a real application. 

The real issue is that NTEventLogAppender itself does not register
properly with regsvr32 to begin with. Curt Arnold earlier gave some
clues on that as he wrote:

"If it appears to be missing header files, it is likely files that are
produced by javah that generate the header required to implement the
java native methods."

Since the downloaded log4j package does not provide complete source
files required to build the whole DLL thing, I was hoping that someone
involved in the log4j development could provide some more help here.

Regards,
Shuh


------------------------------------------------------------------------
--------
From: PERTUISET Emilie [mailto:emilie.pertuiset@c-s.fr] 
Sent: Wednesday, December 13, 2006 4:08 AM
To: CHANG Shuh
Subject: Problem Event Id 4096 and log4j


Hello,

I have seen on a web site that you had had the following problem :

However, for the NTEventLogAppender appender, I keep getting
annoyingEventLog message in the Event Viewer:The description for Event
ID ( 4096 ) in Source ( Log4j ) cannot be found.The local computer may
not have the necessary registry information ormessage DLL files to
display messages from a remote computer. You may beable to use the
/AUXSOURCE= flag to retrieve this description; see Help andSupport for
details. The following information is part of the event: [myreal log
info displays correctly here...]I have searched for an answer for this
(well-known?) problem. However, allthe "solutions" that I found so far
do not apply to my situation.
 
Have you had an answer for this problem?
Or did you find a solution?
I will be very interested by this one. 
I have the same problem and I use log4j-1.2.14.
Thank you, in advance, for your help.
 
Best Regards,
Emilie Pertuiset
 

-----Original Message-----
From: Shuh Chang [mailto:shuh.chang@gemalto.com] 
Sent: Wednesday, November 22, 2006 1:58 PM
To: Log4J Users List
Subject: RE: NTEventLogAppender with missing description source for
Windows Server 2003

I need to make a correction: I just found out that the
NTEventLogAppender.dll *does* create the default "Log4j" entry (or any
other source specified in the log4j.properties) in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Applicatio
n\So
urces registry.  That's my mistake. Sorry about that.

Nonetheless, the NTEventLogAppender.dll still couldn't be properly
loaded/registered in the registry by the regsvr32 command, which causes
the extra annoying messages in the event viewer.

Regards,
Shuh



---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-user-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-user-help@logging.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-user-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-user-help@logging.apache.org

Re: NTEventLogAppender with missing description source for Windows Server 2003

[Curt Arnold <ca...@apache.org>]

On Dec 13, 2006, at 10:43 AM, CHANG Shuh wrote:

> Hi Emilie,
>
> Thanks for your inquiry. Please keep all inquiries on the log4j-user
> list.
>
> No, I have not heard much back to resolve this issue. I am hoping that
> someone who knows the answer could help out.
>
> Basically, the NTEventLogAppender works to capture the log information
> in the Event Viewer, except that it also generates those extra  
> annoying
> messages for every log that you send. These extra messages clog up  
> (and
> probably mislead) the real log message that makes the  
> NTEventLogAppender
> somewhat unrealistic for a real application.
>
> The real issue is that NTEventLogAppender itself does not register
> properly with regsvr32 to begin with. Curt Arnold earlier gave some
> clues on that as he wrote:
>
> "If it appears to be missing header files, it is likely files that are
> produced by javah that generate the header required to implement the
> java native methods."
>
> Since the downloaded log4j package does not provide complete source
> files required to build the whole DLL thing, I was hoping that someone
> involved in the log4j development could provide some more help here.
>
> Regards,
> Shuh
>


I believe that you misinterpreted my response.  The log4j package  
does include all files necessary to rebuild NTEventLogAppender.dll,  
it is not missing any files.  If you run the ant target  
"build.nt.dll" on Windows with MinGW on the path (I believe that I  
use MinGW 3.1 or 3.1.1), NTEventLogAppender.dll will be built.  It  
appears that you were attempting to build the appender without using  
the build script and did not use javah to create the supposedly  
missing header files corresponding to the java classes  
org.apache.log4j.nt.NTEventLogAppender and org.apache.log4j.Priority.

regsvr32 does not find a DllRegisterServer in NTEventLogAppender.dll  
since that entry point was never written.  Just having a  
DllRegisterServer entry point would satisfy regsvr32, but it would  
not address the unregistered message file issues.

To enhance the NTEventLogAppender.dll to address your observed  
complaints, a DllRegisterServer and DllUnregisterServer entry points  
would need to be added to NTEventLogAppender.dll.  The implementation  
of DllRegisterServer would need to determine the full path to  
NTEventLogAppender.dll using GetModuleFileName() and then would need  
to register the DLL as a message source as described in http:// 
msdn2.microsoft.com/en-us/library/aa363661.aspx.  The DLL does appear  
to contain the necessary message resource, it just doesn't appear to  
have any code that attempts to register itself. What you are  
experiencing is exactly what is described at the bottom of that page.

> An application can use the Application log without adding a new  
> event source to the registry. If the application calls  
> RegisterEventSource, passing a source name that cannot be found in  
> the registry, the event-logging service uses the Application log by  
> default. However, because there are no message files, the Event  
> Viewer cannot map any event identifiers or event categories to a  
> description string, and will display an error. For this reason, you  
> should add a unique event source to the registry for your  
> application and specify a message file.

To recap:

1. log4j 1.2.14 isn't missing any files.  The files that you thought  
were missing are generated using javah in the build script.  If you  
don't use the build script, you have to manually perform all the  
steps in to compile the message files, resource files, and generate  
the header files corresponding to the needed java classes.
2. The observed behavior isn't a regression.  That is, it didn't stop  
working, it just never had the necessary code to implement  
registering itself as an event source.
3. The observed behavior isn't desirable.  A patch that added a  
DllRegisterServer entry point to make the appropriate registry  
entries would be a helpful contribution as an enhancement.  If anyone  
would like to take a shot and contribute your work, create a new bug  
in Bugzilla and then after creating the bug attach a patch file.


---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-user-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-user-help@logging.apache.org