Writing to NT event log

I'm trying to write to the NT event log from a module but it doesn't appear to be working and the VB docs are a little sketchy on this subject.  I have this line:

App.StartLogging "", vbLogToNT

I added a watch for "App" and stepped through the code and noticed that LogMode never changes from 0.  I expected it to change to 3.  Is this behavior correct?

Later in the code I have this:

App.LogEvent "Directory Created", 4

The program does go over this line when I step through it but nothing shows up in my event log.

I'm running this on NT Server 4.0 SP5 with VB6 SP3.

The program consists of two modules.  All input is from the command line.
LVL 2
jbuntingAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

watyCommented:
Here is cool code to write to eventlog :

' #VBIDEUtils#************************************************************
' * Programmer Name  : Waty Thierry
' * Web Site         : www.geocities.com/ResearchTriangle/6311/
' * E-Mail           : waty.thierry@usa.net
' * Date             : 28/09/98
' * Time             : 10:41
' * Module Name      : EventLog_Module
' * Module Filename  : EventLog.Bas
' **********************************************************************
' * Comments         : Declarations to add entries to the eventlog
' *
' *
' **********************************************************************

Option Explicit

'=============================================
'API/DLL Procedure Declaration Section
'=============================================

Declare Function GetLastError Lib "kernel32" () As Long
Declare Function DeregisterEventSource Lib "advapi32.dll" (ByVal hEventLog As Long) As Long
Declare Function RegisterEventSource Lib "advapi32.dll" Alias "RegisterEventSourceA" (ByVal lpUNCServerName As String, ByVal lpSourceName As String) As Long
Declare Function ClearEventLog Lib "advapi32.dll" Alias "ClearEventLogA" (ByVal hEventLog As Long, ByVal lpBackupFileName As String) As Long
Declare Function BackupEventLog Lib "advapi32.dll" Alias "BackupEventLogA" (ByVal hEventLog As Long, ByVal lpBackupFileName As String) As Long
Declare Function GetNumberOfEventLogRecords Lib "advapi32.dll" (ByVal hEventLog As Long, NumberOfRecords As Long) As Long

' *** NOTICE: The following declare has been modified from Win32API.txt
Declare Function ReportEvent Lib "advapi32.dll" Alias "ReportEventA" (ByVal hEventLog As Long, ByVal wType As Long, ByVal wCategory As Long, ByVal dwEventID As Long, ByRef lpUserSid As Any, ByVal wNumStrings As Long, ByVal dwDataSize As Long, ByRef lpStrings As String, ByRef lpRawData As Any) As Long

Global Const EVENTLOG_ERROR_TYPE = 1
Global Const EVENTLOG_WARNING_TYPE = 2
Global Const EVENTLOG_INFORMATION_TYPE = 4

Type EVENTLOGRECORD
   Length                As Long     '  Length of full record
   Reserved              As Long     '  Used by the service
   RecordNumber          As Long     '  Absolute record number
   TimeGenerated         As Long     '  Seconds since 1-1-1970
   TimeWritten           As Long     '  Seconds since 1-1-1970
   EventID               As Long
   EventType             As Integer
   NumStrings            As Integer
   EventCategory         As Integer
   ReservedFlags         As Integer  '  For use with paired events (auditing)
   ClosingRecordNumber   As Long     '  For use with paired events (auditing)
   StringOffset          As Long     '  Offset from beginning of record
   UserSidLength         As Long
   UserSidOffset         As Long
   DataLength            As Long
   DataOffset            As Long     '  Offset from beginning of record
End Type


' *** Add this in a class


' #VBIDEUtils#************************************************************
' * Programmer Name  : Waty Thierry
' * Web Site         : www.geocities.com/ResearchTriangle/6311/
' * E-Mail           : waty.thierry@usa.net
' * Date             : 28/09/98
' * Time             : 10:42
' * Module Name      : class_EventLog
' * Module Filename  : EventLog.cls
' **********************************************************************
' * Comments         : Add event to the enventlog under NT
' *
' *
' **********************************************************************

Option Explicit

'=============================================
'Module Level Constant Declaration Section
'=============================================
Private Const RAW_TYPE_NONE = 0
Private Const RAW_TYPE_BYTE = 1
Private Const RAW_TYPE_LONG = 2

'=============================================
'Module Level Variable Declaration Section
'=============================================
Private m_hEventSource  As Long        'Event source handle
Private m_sEventSource  As String      'Event source name
Private m_lEventID      As Long        'Event ID
Private m_nEventType    As Integer     'Event type
Private m_nRawDataType  As Integer     'Type of the raw data
Private m_bRawData()    As Byte        'Raw byte data
Private m_lRawData()    As Long        'Raw long data
Private m_lRawDataSize  As Long        'Size of the raw data
Private m_sStringParam  As String      'Substitution string
Private m_lNumStrings   As Long        '1=string present, 0=not present

Public Property Let EventSource(Source As String)
   ' *** This property is used to set the source of the event.
   ' *** The name of a source defined in the registry.
   
   m_sEventSource = Source
   
End Property

Public Property Let EventID(ID As Long)
   ' *** This property is used to set the ID of the event.
   ' *** The IDs are defined in the message file for the
   ' *** particular source.
   
   m_lEventID = ID
   
End Property

Public Property Let EventType(EType As Integer)
   ' *** This property is used to set the type of the event.
   ' *** Event types are defined in EventLog.bas
   
   If EType = EVENTLOG_ERROR_TYPE Or EType = EVENTLOG_INFORMATION_TYPE Or EType = EVENTLOG_WARNING_TYPE Then m_nEventType = EType
   
End Property

Public Property Let RawData(ByRef data As Variant)
   ' *** This property is used to set the value of the raw data
   ' *** to be written to the event log.
   
   ' *** Data : The raw data to be written to the log
   ' ***        This must be either a value or array of any
   ' ***        of the following types: Long, Integer, Byte
   
   '   =============================================
   '   Local Constant/Variable Declaration Section
   '   =============================================
   Dim nElement   As Integer
   
   ' *** Determine the type and size of the data
   Select Case TypeName(data)
      Case "Long()"
         ' *** Array of longs
         
         m_nRawDataType = RAW_TYPE_LONG
         m_lRawDataSize = (UBound(data) + 1) * 4
         ReDim m_lRawData(UBound(data))
         For nElement = 0 To UBound(data)
            m_lRawData(nElement) = data(nElement)
         Next
         
      Case "Long"
         ' *** Single long
         
         m_nRawDataType = RAW_TYPE_LONG
         m_lRawDataSize = 4
         ReDim m_lRawData(0)
         m_lRawData(0) = data
         
      Case "Byte()"
         ' *** Array of bytes
         
         m_nRawDataType = RAW_TYPE_BYTE
         m_lRawDataSize = UBound(data) + 1
         ReDim m_bRawData(UBound(data))
         For nElement = 0 To UBound(data)
            m_bRawData(nElement) = data(nElement)
         Next
         
      Case "Byte"
         ' *** Single byte
         
         m_nRawDataType = RAW_TYPE_BYTE
         m_lRawDataSize = 1
         ReDim m_bRawData(0)
         m_bRawData(0) = data
         
      Case Else
         ' *** Invalid type
         
         m_nRawDataType = RAW_TYPE_NONE
         m_lRawDataSize = 0
         
   End Select
   
End Property

Public Property Let StringParam(sParam As String)
   ' *** This method is used to set the substitution string in the event
   ' *** description.
   
   m_sStringParam = sParam
   m_lNumStrings = IIf(m_sStringParam = "", 0, 1)
   
End Property

Public Function EventLogReport(Optional Source As Variant, Optional EType As Variant, Optional ID As Variant, Optional ByRef data As Variant, Optional Param As Variant) As Long
   ' *** This method is used to write an event to the Application log.
   
   ' *** Source The name of the event source (opional, may be set through properties)
   ' *** EType  The type as defined in EventLog.bas (opional, may be set through properties)
   ' *** ID     The ID within the event source (opional, may be set through properties)
   ' *** Data   The array of raw data (opional, may be set through properties)
   ' *** Param  The substitution string (opional, may be set through properties)
   
   Dim lCatagory    As Long
   Dim lResult      As Long
   Dim vUserSiD     As Variant
   
   EventLogReport = 0
   lCatagory = 0
   vUserSiD = Null
   
   ' *** Check if parameters passed
   If Not IsMissing(Source) Then EventSource = Source
   If Not IsMissing(ID) Then EventID = ID
   If Not IsMissing(EType) Then EventType = EType
   If Not IsMissing(data) Then RawData = data
   If Not IsMissing(Param) Then StringParam = Param
   
   ' *** Get an handle to the event log
   m_hEventSource = RegisterEventSource(vbNullString, m_sEventSource)
   
   ' *** If registration was successful, report event
   If m_hEventSource <> 0 Then
      Select Case m_nRawDataType
         Case RAW_TYPE_BYTE
            lResult = ReportEvent(m_hEventSource, m_nEventType, lCatagory, m_lEventID, vUserSiD, m_lNumStrings, m_lRawDataSize, m_sStringParam, m_bRawData(0))
           
         Case RAW_TYPE_LONG
            lResult = ReportEvent(m_hEventSource, m_nEventType, lCatagory, m_lEventID, vUserSiD, m_lNumStrings, m_lRawDataSize, m_sStringParam, m_lRawData(0))
           
         Case RAW_TYPE_NONE
            lResult = ReportEvent(m_hEventSource, m_nEventType, lCatagory, m_lEventID, vUserSiD, m_lNumStrings, m_lRawDataSize, m_sStringParam, vbNullString)
           
      End Select
     
      ' *** If report event failed, get the error number
      If lResult = 0 Then EventLogReport = GetLastError()
     
      ' *** Release the handle and reset the variables
      lResult = DeregisterEventSource(m_hEventSource)
      m_sEventSource = ""
      m_lEventID = 0
      m_nEventType = EVENTLOG_INFORMATION_TYPE
      m_nRawDataType = RAW_TYPE_NONE
      m_lRawDataSize = 0
      m_sStringParam = ""
      m_lNumStrings = 0
     
   Else
      EventLogReport = GetLastError()
     
   End If
   
End Function
Public Function EventLogBackup(sFileName As Variant, Optional Source As Variant) As Long
   ' *** This method is used to backup the event log.
   
   ' *** Source The name of the event source (opional, may be set through properties)
   
   Dim lResult       As Long
   
   ' *** Check if parameters passed
   If Not IsMissing(Source) Then EventSource = Source
   
   ' *** Get an handle to the event log
   m_hEventSource = RegisterEventSource(vbNullString, m_sEventSource)
   
   If m_hEventSource <> 0 Then
      lResult = BackupEventLog(m_hEventSource, sFileName)
     
      ' *** If report event failed, get the error number
      If lResult = 0 Then EventLogBackup = GetLastError()
     
      ' *** Release the handle and reset the variables
      lResult = DeregisterEventSource(m_hEventSource)
     
   Else
      EventLogBackup = GetLastError()
     
   End If
   
End Function
Public Function EventLogClear(Optional Source As Variant) As Long
   ' *** This method is used to clear the event log.
   
   ' *** Source The name of the event source (opional, may be set through properties)
   
   Dim lResult       As Long
   
   ' *** Check if parameters passed
   If Not IsMissing(Source) Then EventSource = Source
   
   ' *** Get an handle to the event log
   m_hEventSource = RegisterEventSource(vbNullString, m_sEventSource)
   
   If m_hEventSource <> 0 Then
      lResult = ClearEventLog(m_hEventSource, vbNullString)
     
      ' *** If report event failed, get the error number
      If lResult = 0 Then EventLogClear = GetLastError()
     
      ' *** Release the handle and reset the variables
      lResult = DeregisterEventSource(m_hEventSource)
     
   Else
      EventLogClear = GetLastError()
     
   End If
   
End Function

Private Sub Class_Initialize()
   ' *** This procedure is called when the object is instantiated.
   ' *** It initializes the global variables.
   
   m_sStringParam = ""
   m_nRawDataType = RAW_TYPE_NONE
   
End Sub

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
watyCommented:
Also, for your infos :

Read the NT Eventlog
http://www.netfokus.dk/vbadmincode/code/wp0396.zip

The best example of how to write to the NT eventlog. Done by VB/NT specialist L.J. Johnson. You will find his webpage on the link page.                    
Author: L.J.Johnsonhttp://www.netfokus.dk/vbadmincode/code/wp0996p.zip


Write to the eventlog
http://support.microsoft.com/support/kb/articles/q154/5/76.asp


This is simple and scaled down example of how to register a program to the NT eventlog and write to the log. The registration is based on L.J. Johnsons code.
Author: Morten Brunhttp://www.netfokus.dk/vbadmincode/code/nteventlog.zip


A NT eventlog monitor with filters, and many options.
http://www.netfokus.dk/vbadmincode/code/smonitor.zip
0
Éric MoreauSenior .Net ConsultantCommented:
waty wrote a lot but the problem here is that when your application run in VB IDE, it can't write (using LogEvent) to the LogEvent.

Compile your application and execute. You will see your messages in the event viewer!
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

jbuntingAuthor Commented:
Thank you for the code!  It is much better than using the built-in vb routines.
0
jbuntingAuthor Commented:
Thank you too, emoreau, for answering the original question.  How can I give you credit too?
0
Éric MoreauSenior .Net ConsultantCommented:
You need to post a new question that looks like "For emoreau".
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Visual Basic Classic

From novice to tech pro — start learning today.