Today we are going to look at an important service provided by Windows which most large server/service types of applications use. This feature is Event Logging. You must have seen the event log in Windows. If you have not, just go to Control Panel->Administrators Tools->Event Viewer and check that out.

You can see the Application, security and system event log here. The entries in these logs are generated by different applications, indicating some information, error condition and anything else they want to log. So Event Log is a central repository, where different applications can log their events instead of using their own customized log files or logging repositories.

This helps the user/administrator of your server/service to locate all the events from different sources at one location.

So how will you add event logging capability to your application? The first step is to write a message file. Message files are simple text files which contain information about all the events you are going to log. These messages are composed of a message id, the severity code, a symbolic name, language the message is in and a category. You can refer to MSDN to know what event id's, categories etc are. The message files have a .mc extension. Next step is to compile the message files using a message compiler. VS comes with it's own message compiler named mc.exe. The messages are stored as resources, so once you compile the message files, you will get .rc and .bin files (resource files). You then have to compile these resource files using resource compiler (rc.exe) to get a .res file. This .res file can then be linked using standard linker to give us a .dll which contains our messages as resources.

You can refer to MSDN for more information on these steps. This dll will now be used as an event source of your application. Refer to MSDN for more information on event sources, and registering an event source.

You can now use ReportEvent() API to log events to system log. If you have registered the event source properly, you will see the log, it's message, associated data etc.

You can try ReportEvent() even without a message file. This will log your event to the event log with associated data, but the system will not be able to display the event message since it can't find the message file.

3. Develop a proper message file, register your event source and write an application to log system events using this message file. Check the result of these events.

Event logs are very important when we are developing server kind of applications. In most cases, these applications will run on server machines, and would be looked after by administrators. Administrators hate to go to each service's log files and check them out, and the log files themselves can be absolutely different from application to application. So it's important if you want to reduce post release support, that you provide proper event logging to system event log where the user/admin can manage the application.

Event logging does involve some overheads, so you should be cautious not to overkill your application/service with system event log if it does not need it.