IoAllocateErrorLogEntry character limits

NTDEV
1

Hello,
I’d like to add an insertion string with approximately 128 wide characters to the Event Log. IoAllocateErrorLogEntry is failing because the size I need is larger than ERROR_LOG_MAXIMUM_SIZE. Is there away of getting around this? Perhaps another logging function that I am not aware of?

Thanks

2

wrote in message news:xxxxx@ntdev…
> Hello,
> I’d like to add an insertion string with approximately 128 wide characters to the Event Log. IoAllocateErrorLogEntry is
> failing because the size I need is larger than ERROR_LOG_MAXIMUM_SIZE. Is there away of getting around this? Perhaps another
> logging function that I am not aware of?

Use trace (ETW)

–PA

3

You have a maximum of 256, which includes the header. So if your buffer size
is 128 wide, that’s already 256, when you add the header you over flow the
buffer.

–
The personal opinion of
Gary G. Little

wrote in message news:xxxxx@ntdev…
> Hello,
> I’d like to add an insertion string with approximately 128 wide
> characters to the Event Log. IoAllocateErrorLogEntry is failing because
> the size I need is larger than ERROR_LOG_MAXIMUM_SIZE. Is there away of
> getting around this? Perhaps another logging function that I am not aware
> of?
>
> Thanks
>

4

No, don’t use ETW these have totally different purposes. I view ETW as a
diagnostic log for the developer, i.e. everything from I’m starting to
calling a function, to dumping the complete register set of a device.

The Event Log is a system management tool, it should report unexpected
behavior and exceptional conditions to the Administrator. Most of the
network management tools monitor the Event Log and report the data to the
administrative applications.

Now if the use really needs a big string for the Event Log, they will need
to put split the message into two pieces. But one has to ask if this is
just a lazy Event Log action of a generic entry with the string giving the
details. I most cases I have seen of people having the too much data
problem, replacing a generic entry with a bunch of specific log events
reduces or eliminates the problem.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Pavel A.” wrote in message news:xxxxx@ntdev…
> wrote in message news:xxxxx@ntdev…
>> Hello,
>> I’d like to add an insertion string with approximately 128 wide
>> characters to the Event Log. IoAllocateErrorLogEntry is failing because
>> the size I need is larger than ERROR_LOG_MAXIMUM_SIZE. Is there away of
>> getting around this? Perhaps another logging function that I am not
>> aware of?
>
> Use trace (ETW)
>
> --PA
>
>