I have some questions about writing to the event log from a driver. I’ve been looking at some MSDN resources about logging errors, here:
https://msdn.microsoft.com/en-us/library/windows/hardware/ff554312(v=vs.85).aspx
I’m unclear about what facility names are and how I should define them in my .mc file. I did find a userspace-oriented reference with a concrete example:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa363680(v=vs.85).aspx
It seems to suggest that I should define four facility names:
FacilityNames=(System=0x0:FACILITY_SYSTEM
Runtime=0x2:FACILITY_RUNTIME
Stubs=0x3:FACILITY_STUBS
Io=0x4:FACILITY_IO_ERROR_CODE
)
I also found C:\WinDDK\7600.16385.1\src\serial\serial\serlog.mc, which defines them slightly differently (note the references to “RPC”:
FacilityNames=(System=0x0
RpcRuntime=0x2:FACILITY_RPC_RUNTIME
RpcStubs=0x3:FACILITY_RPC_STUBS
Io=0x4:FACILITY_IO_ERROR_CODE
Serial=0x6:FACILITY_SERIAL_ERROR_CODE
)
Comparing these two, it seems as if the serial example has defined its own unique facility name, which is consistent with my (probably inaccurate) understanding that the facility name is meant to distinguish messages from one driver versus another. So, what facility name should I define for my driver, and how do I ensure that the number I assign to it does not collide with anybody else’s driver?
Am I overthinking this? Should I just move forward copying the first example I cited above for FacilityNames and simply specify System as the facility for each of the messages I define? Or should I define an 0x6 of my own and call it whatever I want, and move on from there? Are there other resources I should be looking at? Am I going about driver event logging all wrong?
Based on the information available to me, I did concoct a .mc file that I was able to feed through mc.exe, then rc.exe, then link.exe, resulting in a DLL. It looks similar to this (note that I used Runtime for my facility, though on further consideration, I suspect that System makes more sense, or better yet, a facilityname of my own [but with what number assigned to it?]):
MessageIdTypedef=NTSTATUS
SeverityNames = (
Success = 0x0:STATUS_SEVERITY_SUCCESS
Informational = 0x1:STATUS_SEVERITY_INFORMATIONAL
Warning = 0x2:STATUS_SEVERITY_WARNING
Error = 0x3:STATUS_SEVERITY_ERROR
)
FacilityNames=(System=0x0:FACILITY_SYSTEM
Runtime=0x2:FACILITY_RUNTIME
Stubs=0x3:FACILITY_STUBS
Io=0x4:FACILITY_IO_ERROR_CODE
)
LanguageNames=(English=0x409:MSG00409)
MessageId=0x1
Severity=Error
Facility=Runtime
SymbolicName=MSG_TEST
Language=English
Test message: %1
Insertion string percent two: %2
.
What is the correct way to proceed.
Thanks,
Mike