Visual Basic > Windows and Controls

Writing to the NT event log

Writing to the NT event log

Below is the basic outline of a class used to write data to the NT event log. An example is included at the bottom of this post.

----Add this to a class called "clsEventLog"

Option Explicit

Private zsSource As String
Private Declare Function RegisterEventSource Lib "advapi32.dll" Alias "RegisterEventSourceA" (ByVal lpUNCServerName As String, ByVal lpSourceName As String) As Long
Private Declare Function DeregisterEventSource Lib "advapi32.dll" (ByVal hEventLog As Long) As Long
Private Declare Function ReportEvent Lib "advapi32.dll" Alias "ReportEventA" (ByVal hEventLog As Long, ByVal wType As Long, ByVal wCategory As Long, ByVal dwEventID As Long, lpUserSid As Any, ByVal wNumStrings As Long, ByVal dwDataSize As Long, lpStrings As String, lpRawData As Any) As Long

Private Declare Function GetLastError Lib "kernel32" () As Long

Private Declare Function OpenEventLog Lib "advapi32.dll" Alias "OpenEventLogA" (ByVal lpUNCServerName As String, ByVal lpSourceName As String) As Long
Private Declare Function CloseEventLog Lib "advapi32.dll" (ByVal hEventLog As Long) As Long
Private Declare Function BackupEventLog Lib "advapi32.dll" Alias "BackupEventLogA" (ByVal hEventLog As Long, ByVal lpBackupFileName As String) As Long
Private Declare Function ClearEventLog Lib "advapi32.dll" Alias "ClearEventLogA" (ByVal hEventLog As Long, ByVal lpBackupFileName As String) As Long
Private Declare Function GetNumberOfEventLogRecords Lib "advapi32.dll" (ByVal hEventLog As Long, NumberOfRecords As Long) As Long
Private Declare Function GetOldestEventLogRecord Lib "advapi32.dll" (ByVal hEventLog As Long, OldestRecord As Long) As Long

Private Type EVENTLOGRECORD
   Length As Long   ' Length of full record
   Reserved As Long   ' Used by the service
   RecordNumber As Long   ' Absolute record number
   TimeGenerated As Long   ' Seconds since 1-1-1970
   TimeWritten As Long   'Seconds since 1-1-1970
   EventID As Long
   EventType As Integer
   NumStrings As Integer
   EventCategory As Integer
   ReservedFlags As Integer   ' For use with paired events (auditing)
   ClosingRecordNumber As Long   'For use with paired events (auditing)
   StringOffset As Long   ' Offset from beginning of record
   UserSidLength As Long
   UserSidOffset As Long
   DataLength As Long
   DataOffset As Long   ' Offset from beginning of record
End Type

Public Enum eevLogType
    EVENTLOG_SUCCESS = 0
    EVENTLOG_ERROR_TYPE = 1
    EVENTLOG_WARNING_TYPE = 2
    EVENTLOG_INFORMATION_TYPE = 4
    EVENTLOG_AUDIT_SUCCESS = 8
    EVENTLOG_AUDIT_FAILURE = 10
End Enum


Property Get Source() As String
    Source = zsSource
End Property

Property Let Source(Value As String)
    zsSource = Value
End Property


Function Log(sTitle As String, sMessage As String, eLogType As eevLogType) As Boolean
    Dim lLenMessage As Long
    Dim lhwndEventLog As Long
    
    lhwndEventLog = RegisterEventSource("", zsSource)
    
    lLenMessage = Len(sTitle) + 1
    
    'Write the event in the application event log
    If ReportEvent(lhwndEventLog, eLogType, 0, 1, ByVal 0&, 1, 0, sMessage, ByVal 0&) = 0 Then
        'Failed
        Log = False
    Else
        'Success
        Log = True
    End If
    
    If lhwndEventLog Then
        DeregisterEventSource lhwndEventLog
    End If
End Function

Private Sub Class_Initialize()
    zsSource = "VB Event Log"
End Sub


Sub ViewLog()
    Shell "eventvwr.exe", vbNormalFocus
End Sub

----Add this to a standard module

Option Explicit

'Example code
Sub TestLog()
    Dim oEventLog As clsEventLog
    Set oEventLog = New clsEventLog
    oEventLog.Source = "Andrew Test"
    oEventLog.Log "TEST", "TEST MESSAGE", EVENTLOG_ERROR_TYPE
End Sub