add function to create custom event log under Microsoft Event Viewer

[reedlaw]

This function allows creation of an event log with a custom name (i.e. not "Application").

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[reedlaw]

@googlebot I signed it!

[googlebot]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[gopherbot]

This PR (HEAD: 236ae2b) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/sys/+/198493 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

[gopherbot]

Message from Gobot Gobot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
Within the next week or so, a maintainer will review your change and provide
feedback. See https://golang.org/doc/contribute.html#review for more info and
tips to get your patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11, it means that this CL will be reviewed as part of the next development
cycle. See https://golang.org/s/release for more details.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Alex Brainman:

Patch Set 1:

(2 comments)

Thank you for your contribution.

I am unclear about what you are trying to build here. So I did not do thorough review. I will do that once we agree on the plan.

Alex

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Reed Law:

Patch Set 1:

(1 comment)

Patch Set 1:

(2 comments)

Thank you for your contribution.

I am unclear about what you are trying to build here. So I did not do thorough review. I will do that once we agree on the plan.

Alex

The impetus behind this is that the behavior of the current implementation is to log all messages under the "Windows Logs -> Application" event source. Many applications log events to custom sources under "Applications and Services Logs". The process for manually creating a custom event log source is quite cumbersome unless you leverage .NET (see https://docs.microsoft.com/en-us/windows/win32/eventlog/message-files and https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.createeventsource?view=netframework-4.8). A workaround that many have utilized (e.g. https://www.jasonsamuel.com/2010/01/08/creating-a-custom-event-log-under-event-viewer-to-log-server-events/) is to use the existing message file provided by .NET.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Reed Law:

Patch Set 1:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Alex Brainman:

Patch Set 1:

(1 comment)

Sorry but I am not convinced that this change is correct and useful enough to be included in this package. I suspect that different people will require different keys / values created. I think it is easy enough to do this in their own code.

If you disagree, you could easily publish functions to create and remove custom event log in your own package, and make them public.

Alex

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Reed Law:

Patch Set 1:

Patch Set 1:

(1 comment)

Sorry but I am not convinced that this change is correct and useful enough to be included in this package. I suspect that different people will require different keys / values created. I think it is easy enough to do this in their own code.

If you disagree, you could easily publish functions to create and remove custom event log in your own package, and make them public.

Alex

Maybe I should file a bug because when I run the example (from golang.org/x/sys/windows/svc/example) I get this error:

PS C:> .\example.exe install
2019/11/04 23:26:58 failed to install myservice: SetupEventLogSource() failed: The handle is invalid.

If I ignore that error and try logging a message (with elog, err := eventlog.Open(name); elog.Info(1, fmt.Sprintf("%s service", name))), I can see it in Windows Event Viewer but surrounded with this message:

The description for Event ID 1 from source myservice cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

myservice service

the message resource is present but the message is not found in the string/message table

It looks like undesired behavior to me. I understand the hesitancy to reference seemingly random files. Perhaps I didn't describe the issue well to begin with. The Windows Dev Center links I shared were meant to outline in rough form the steps required to get an event source set up. If you are using .NET it's much simpler using CreateEventSource. That method sets up the registry keys in the same way as I have done here.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Alex Brainman:

Patch Set 1:

Maybe I should file a bug because when I run the example (from golang.org/x/sys/windows/svc/example) I get this error:

PS C:> .\example.exe install
2019/11/04 23:26:58 failed to install myservice: SetupEventLogSource() failed: The handle is invalid.

I agree. This is not a very error good message. But you could easily debug this yourself. Just some print statements in golang.org/x/sys/windows/svc/eventlog.Install function to see what fails and why.

And you are always welcome to file bugs at https://golang.org/issue . I don't promise to fix them, but there are many other contributors who are willing to help.

If I ignore that error and try logging a message (with elog, err := eventlog.Open(name); elog.Info(1, fmt.Sprintf("%s service", name))), I can see it in Windows Event Viewer but surrounded with this message:

The description for Event ID 1 from source myservice cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

myservice service

the message resource is present but the message is not found in the string/message table

I am not sure exactly what you have done. Maybe show us your exact code. But you will see event log message like this when service registry is not setup properly.

It looks like undesired behavior to me. I understand the hesitancy to reference seemingly random files. Perhaps I didn't describe the issue well to begin with. The Windows Dev Center links I shared were meant to outline in rough form the steps required to get an event source set up. If you are using .NET it's much simpler using CreateEventSource. That method sets up the registry keys in the same way as I have done here.

If you are referring to

https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.createeventsource?view=netframework-4.8

as prove that you implementation is correct, then I don't see it. Where are all keys and values you are creating in this document? I cannot just accept your word that your code is correct.

Alex

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Reed Law:

Patch Set 1:

I appreciate your taking time to review and, most of all, providing this code to begin with. Without it I could not have gotten to where I am now, and I was merely trying to prevent others from experiencing the same frustrations I had with the Windows API. Given I'm not interested in proving my implementation correct and you're not willing to merge it, I thought I'd leave it as a gist for the sake of others who may find it useful: https://gist.github.com/reedlaw/61bb51a1c10326b9fb82162d09388b5c

One last thought is that we may be dealing with different Windows versions and thus are not seeing the same results. I'm testing on Windows Server 2012 R2. Thanks again, and feel free to close this merge request.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Alex Brainman:

Patch Set 1:

... I thought I'd leave it as a gist for the sake of others who may find it useful: https://gist.github.com/reedlaw/61bb51a1c10326b9fb82162d09388b5c

If you really want your code to be useful to others, you should create Go package instead. So Gophers can download it with simple "go get" command. And also provide nice documentation comments.

Just create

github.com/reedlaw/customeventlog

package with these too functions

// InstallCustomLog creates a custom event log under Microsoft Event Viewer.
func InstallCustomLog(name string, src string, eventsSupported uint32) error

// RemoveCustomLog deletes all registry elements installed by the correspondent InstallCustomLog.
func RemoveCustomLog(name string, src string) error

You already have the code. It just a matter of creating new Github repo and copying your code there.

One last thought is that we may be dealing with different Windows versions and thus are not seeing the same results. I'm testing on Windows Server 2012 R2. Thanks again, and feel free to close this merge request.

I don't see this a problem. I use both Windows 10 and Windows 7. And Go builders test code on many different Windows versions, including Windows Server 2012. If you go to https://build.golang.org , you can see it for yourself.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Go Bot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
Within the next week or so, a maintainer will review your change and provide
feedback. See https://golang.org/doc/contribute.html#review for more info and
tips to get your patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11, it means that this CL will be reviewed as part of the next development
cycle. See https://golang.org/s/release for more details.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/198493.
After addressing review feedback, remember to publish your drafts!