Eventlog EventText is empty

KS-Soft · Post by **KS-Soft** » Mon Feb 01, 2010 4:18 pm

Does it really show complete description or just variables?
What exactly text do you see?

Yes, I know this class (Win32_NTLogEvent) provide event description when everything works properly. Actually HostMonitor uses WMI as well when it cannot find or load DLL specified as event description source.
However if Event Viewer cannot show description (just variables) and HostMonitor cannot do this either, then Win32_NTLogEvent class should returns just variables as well.

Regards
Alex

MirkoW · Post by **MirkoW** » Tue Feb 02, 2010 2:01 am

Hi,

InsertionStrings contains mostly the same content like Message-Variable. But on eventlogs with ID 0 the Message-Variable is empty and the InsertionStrings contains same Information like eventviewer without the information about the missing description for ID 0

Here are an example with existing Message-Content:

Category: 0
CategoryString:
ComputerName: S-RFSW3-BTP2
Data:
EventCode: 0
EventIdentifier: 0
EventType: 2
InsertionStrings: Could not detect IIS installation or IIS is disabled, skipping the Web Host Script Mappings component since it depends upon IIS to function properly.
If you believe this message is an error, check your IIS installation to make sure it is installed properly.
Logfile: Application
Message: Could not detect IIS installation or IIS is disabled, skipping the Web Host Script Mappings component since it depends upon IIS to function properly.
If you believe this message is an error, check your IIS installation to make sure it is installed properly.

RecordNumber: 153
SourceName: System.ServiceModel.Install 3.0.0.0

TimeGenerated: 11.09.2009 17:51:37

TimeWritten: 11.09.2009 17:51:37
Type: Warning
User:

KS-Soft · Post by **KS-Soft** » Wed Feb 03, 2010 2:38 pm

I see. I have not changed my opinion - there is problem in DLL.
If you do not want to contact Microsoft, we will have to change our code again to check for such DLL problems...

Regards
Alex

MirkoW · Post by **MirkoW** » Thu Feb 04, 2010 3:56 am

i have ask my technical support for biztalk but it is possible to change te code? perhapts other applications can have this problem too.

KS-Soft · Post by **KS-Soft** » Thu Feb 04, 2010 11:30 am

have ask my technical support for biztalk but it is possible to change te code?

Done. Lets try update: www.ks-soft.net/download/hm840.zip

perhapts other applications can have this problem too.

That's my point - if they fix DLL, all applications will dosplay event description correctly.

Regards
Alex

MirkoW · Post by **MirkoW** » Tue Feb 09, 2010 2:31 am

Hi,

I've tested it an i still receive an empty EventText:

Message from HostMonitor (host changed status)

Test : NTLog S-RFSW3-BTP1:BizTalk Server 2006
Method: check NT Event Log
Status : Bad
Date : 09.02.2010 09:01:43

EventSource: BizTalk Server 2006
EventTime: 09.02.2010 08:59:35
EventType: 2
EventID: 0
EventText:

Recurrences : 1
Last status: Ok
Total tests: 163340
Alive ratio : 94,94 %
Dead ratio: 4,87 %

KS-Soft · Post by **KS-Soft** » Tue Feb 09, 2010 7:31 am

Could you send that DLL to us (support@ks-soft.net)?

Regards
Alex

MirkoW · Post by **MirkoW** » Sat Feb 13, 2010 1:32 pm

hi,

now it works. i receive the full eventtext with follow information. But in my WMI-Code i dont receive the additional information: Message not found. Insertion strings

KS-Soft · Post by **KS-Soft** » Mon Feb 15, 2010 10:08 am

now it works. i receive the full eventtext with follow information.

Great

But in my WMI-Code i dont receive the additional information: Message not found. Insertion strings

That's because your script does not check DLL for errors. HostMonitor display such message because DLL does not contain format string for this event.
BTW: Windows Event Viewer works in the same way, just displays different warning message.

Regards
Alex