如何根据需要使用log4cplus在事件日志中记录事件以创建NTEventlogAppender.dll [英] How to create NTEventlogAppender.dll as required for logging event in the eventlog using log4cplus

问题描述

首先，让我感谢log4cplus源代码.

First, Let me thank for the log4cplus source code.

我面临的一个问题如下:

I am facing one issue as follows:

我要做什么? 我想将消息记录到Windows上的事件日志中.

What I am trying to do? I want to log the messages to event log on windows.

我做了什么? 我可以通过包含以下.h

What did I do? I could get the event logging enabled by in including following .h

          #include <log4cplus/nteventlogappender.h>

并按如下所示创建追加器:

And creating the appender as follows:

          SharedAppenderPtr append_3(new NTEventLogAppender(LOG4CPLUS_TEXT("127.0.0.1"), LOG4CPLUS_TEXT("log"), LOG4CPLUS_TEXT("source")));
          append_3->setName(LOG4CPLUS_TEXT("ToEventlog"));

          Logger to_eventlog = Logger::getInstance(LOG4CPLUS_TEXT("to_eventlog"));
          to_eventlog.addAppender(append_3);
          to_eventlog.setLogLevel(log4cplus::ALL_LOG_LEVEL);

并以

         Logger to_eventlog = Logger::getInstance(LOG4CPLUS_TEXT("to_eventlog"));
         LOG4CPLUS_FATAL(to_eventlog, "Test Message.");

当我记录该消息时，我在事件日志中得到了关注:

When I log the message, I get following in the event log:

找不到源源中事件ID 4096的描述.引发此事件的组件未安装在本地计算机上，或者安装已损坏.您可以在本地计算机上安装或修复该组件.

The description for Event ID 4096 from source source cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

如果事件起源于另一台计算机，则显示信息必须与事件一起保存.

If the event originated on another computer, the display information had to be saved with the event.

该事件包含以下信息:

测试消息.

存在消息资源，但在字符串/消息表中找不到消息

the message resource is present but the message is not found in the string/message table

我试图创建一个名称为NTEventLogAppender.dll的dll，该字符串具有字符串表资源和一个ID为4096的字符串(如在log4cplus的nteventlogappender.cxx文件中硬编码)，并仅使用资源dll(/NOENTRY)对其进行编译，但我仍然不断超越错误.

I tried to create a dll with name NTEventLogAppender.dll with string table resource and a string with id 4096 (as hardcoded in the nteventlogappender.cxx file in log4cplus) and compiled it with resource only dll (/NOENTRY) but I still keep getting above error.

我已经尝试过向[e-mail]提问，但尚未得到任何答案.

I already tried question to [e-mail] but did not get any answer yet.

任何有关如何创建此dll的帮助将不胜感激.

Any help on how to create this dll would be greatly appreciated.

谢谢.

推荐答案

这是我解决此问题的方法:

This is how I resolved this issue:

使用以下命令编译NTEventLogAppender.mc文件:

comipiled NTEventLogAppender.mc file using commands:

mc -U NTEventLogAppender.mc
rc -r NTEventLogAppender.rc
link -dll -noentry -out:NTEventLogAppender.dll NTEventLogAppender.res

其中NTEventLogAppender.mc具有以下内容

where NTEventLogAppender.mc has following contents

MessageIdTypedef=DWORD

SeverityNames=(Success=0x0:STATUS_SEVERITY_SUCCESS
Informational=0x1:STATUS_SEVERITY_INFORMATIONAL
Warning=0x2:STATUS_SEVERITY_WARNING
Error=0x3:STATUS_SEVERITY_ERROR
)


FacilityNames=(System=0x0:FACILITY_SYSTEM
Runtime=0x2:FACILITY_RUNTIME
Stubs=0x3:FACILITY_STUBS
Io=0x4:FACILITY_IO_ERROR_CODE
)

LanguageNames=(English=0x409:MSG00409)

; // The following are message definitions.

MessageId=0x1000
SymbolicName=SVC_TEST
Language=English
A message for something.
.

; // A message file must end with a period on its own line
; // followed by a blank line.

---

将NTEventLogAppender.dll复制到c:\ windows \ system32 并运行上述测试程序，发现事件日志正确找到了消息资源.

---

copied the NTEventLogAppender.dll to c:\windows\system32 and ran the above mentioned test program and found that event log found the message resource correctly.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\log\source]
"EventMessageFile"="C:\\windows\\system32\\NTEventLogAppender.dll"
"CategoryMessageFile"="C:\\windows\\system32\\NTEventLogAppender.dll"
"TypesSupported"=dword:00000007
"CategoryCount"=dword:00000005

这篇关于如何根据需要使用log4cplus在事件日志中记录事件以创建NTEventlogAppender.dll的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！