MonitorWare Knowledge Base

by **sjuull** on Tue Apr 08, 2003 1:09 pm

When I use the "Replace Event Log Source" feature in the winsyslog client I get the following message in my eventviewer

The description for Event ID ( xx6 ) in Source ( x.x.x.x ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: --- followed by the "real" message ---

How can I supress this message ?

thanks Sjuull
[/quote]

by **alorbach** on Thu Apr 10, 2003 11:10 am

hi Sjuul,

the problem with this option is, WinSyslog replaces the Eventsource with the IP Address or hostname of a syslog message. The EventlogViewer then tries to find a dll/exe which contains the messagelibs from this EventSource - which it will not find.

Here is also a part of the manual which explains it:

Replace Event Log Source

If checked, a special mapping mechanism is activated. In this mode, the Windows event source is set to the IP address of the system sending the syslog message. In addition, the ID is set to syslog facility. This mode helps to quickly gather information about the system state in Windows event viewer.

However, this mode has its drawbacks. Effectively, we are writing invalid event source information to the event log. This does not harm any application, but Windows event viewer will try to locate the matching message libraries. Of course, this is impossible. As such, event viewer will warn the user that the message library could not be found. Nevertheless, it will display the complete logged message. This happens only in detail view.

Users should fully understand the implications of this mapping mechanism for their environment before turning this option on.

MonitorWare Knowledge Base

Write to eventlog action

Write to eventlog action

Google Ads

Who is online