0

How do I add a description for Event IDs on my Windows Server?

I see this in the event log:

The description for Event ID 7533 from source XXX cannot be found. 
Either the component that raises this event is not installed on your local computer or the installation is corrupted. 
You can install or repair the component on the local computer.
6
  • Event ID 7533 doesn't officially exist. It could be a user defined event, in which case the script/program defining the event should be modified to provide a description.
    – DavidPostill
    Jun 1, 2017 at 10:19
  • Can I add it "officially" to the server so it stops complaining?
    – Damian
    Jun 1, 2017 at 10:58
  • No. You need to modify what is generating the event.
    – DavidPostill
    Jun 1, 2017 at 10:59
  • So the code that generates events can only raise official events? BTW.: I own the source code so I can change it.
    – Damian
    Jun 1, 2017 at 11:09
  • No. You can generate your own events - and give them a description.
    – DavidPostill
    Jun 1, 2017 at 11:10

1 Answer 1

1

Points numbered for reference.

  1. Individual programs define their own EventIDs. There is no consistency, no guide, no rule. The number in the log is for someone looking at the log to report to the developer, so it should point to something specific for easier problem resolution.

  2. There's already an old StackOverflow thread on the topic, where the currently highest-voted answer by @martin says "EventIds are application specific so you can use whatever ranges you like. Just ensure you document what you have used and where so that you can ensure you don't use an id twice, or to facilitate easier debugging."

  3. Interestingly, that thread refers to Microsoft resources which describe the format of Event Identifiers and Message Text Files. But I've never seen those conventions followed for end-user apps. For a specific answer to your question, that Event ID page has this: "Each event source can define its own numbered events and the description strings to which they are mapped in its message file. Event viewers can present these strings to the user."

  4. However, it's interesting that Your application is the one that's causing this message to be displayed. That can indicate that your application has been uninstalled since generating the specific log - or that you didn't create an event Source before you wrote the log. That and other reasons are identified in this Microsoft resource. The current Windows Dev page has details on the EventLog.WriteEntry method.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .