Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
X-Authentication-Warning: slinky.cs.nyu.edu: pechtcha owned process doing -bs
Date: Fri, 14 Mar 2003 13:55:06 -0500 (EST)
From: Igor Pechtchanski <pechtcha AT cs DOT nyu DOT edu>
Reply-To: cygwin AT cygwin DOT com
To: Tino Lange <Tino DOT Lange AT isg DOT de>
cc: cygwin AT cygwin DOT com
Subject: Re: Cygwin's Eventlog Logging (was Re: SSHD on Win2K: sshd.log is 
 just empty)
In-Reply-To: <3E721657.DCE34288@isg.de>
Message-ID: <Pine.GSO.4.44.0303141316410.13439-100000@slinky.cs.nyu.edu>
Importance: Normal
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-ID: <Pine DOT GSO DOT 4 DOT 44 DOT 0303141316412 DOT 13439 AT slinky DOT cs DOT nyu DOT edu>

On Fri, 14 Mar 2003, Tino Lange wrote:

> Meanwhile I found lots of cygwin logs in my eventlog (for example cron,
> ssmtp and sshd).
> But: Why do all those Messages begin with a rather long text stating
> that Windows is not able to show some Event Descriptions?
>
> Attached a screenshot (not bigger than a average cygchek.out, so this
> should be OK, or?), sorry it's in German.
> Somethong like "your local machine doesn't have necessary
> registry-information or information files to display messages from a
> remote computer"
>
> How can I get rid of those annoying parts and only see the relevant
> information?
> What do I need to display that information cygwin want's to give to me?
> It's only with cygwin's eventlog-messages.
>
> Thanks a lot!
> Tino

Tino,

FYI, it's not only with cygwin's event log messages.

Whenever an event is written to the event log, the API also requires an
event code, which is technically a resource ID inside the application:

<http://msdn.microsoft.com/library/en-us/debug/base/reportevent.asp>

Whenever the Event Log Viewer tries to decipher the event, it first
queries the application for the corresponding resource.  The rest of the
event data is supposed to be the detail information for the event
specified by the resource.

Many applications (e.g., HCL Inetd) do not bother to define the resources,
and store all the event information in the data.  Thus, the Event Log
Viewer's query fails, and it displays the message you sent in your screen
shot (with the event data that *is* present).

Cygwin is one of those applications.  Its syslog always gives the event
code of "0" (see the syslog() function in
<http://cygwin.com/cgi-bin/cvsweb.cgi/src/winsup/cygwin/syslog.cc?cvsroot=src>
for details).  FWIW, if you're interested in providing the necessary
resource strings to avoid this message, <http://cygwin.com/acronyms/#PTC> ;-)
	Igor
-- 
				http://cs.nyu.edu/~pechtcha/
      |\      _,,,---,,_		pechtcha AT cs DOT nyu DOT edu
ZZZzz /,`.-'`'    -.  ;-;;,_		igor AT watson DOT ibm DOT com
     |,4-  ) )-,_. ,\ (  `'-'		Igor Pechtchanski
    '---''(_/--'  `-'\_) fL	a.k.a JaguaR-R-R-r-r-r-.-.-.  Meow!

Oh, boy, virtual memory! Now I'm gonna make myself a really *big* RAMdisk!
  -- /usr/games/fortune


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/