.net 无法找到来自源的事件 ID 的描述

Description for event id from source cannot be found

提问by Ji Yalin

When I write a log into windows event log, I get the event below, what's the root cause of this message, and how can I fix it? Many Thanks

当我将日志写入 Windows 事件日志时，我收到以下事件，此消息的根本原因是什么，我该如何解决？非常感谢

The description for Event ID 51001 from source RRWS cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

test log messge

the message resource is present but the message is not found in the string/message table

无法找到来自源 RRWS 的事件 ID 51001 的描述。您的本地计算机上未安装引发此事件的组件或安装已损坏。您可以在本地计算机上安装或修复该组件。

如果事件起源于另一台计算机，则显示信息必须与事件一起保存。

活动中包含以下信息：

测试日志消息

消息资源存在，但在字符串/消息表中找不到该消息

回答by Matt

I got this error after creating an event source under the Application Log from the command line using "EventCreate". This command creates a new key under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

使用“EventCreate”从命令行在应用程序日志下创建事件源后，我收到此错误。此命令在以下位置创建一个新密钥： HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

If you look at the Key that's been created (e.g. SourceTest) there will be a string value calledEventMessageFile, which for me was set to %SystemRoot%\System32\EventCreate.exe.

如果您查看已创建的密钥（例如 SourceTest），将会有一个名为 的字符串值EventMessageFile，对我来说它被设置为%SystemRoot%\System32\EventCreate.exe。

Change this to c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

将此更改为 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

Delete theCustomSourceand TypesSupportedvalues.

删除CustomSource和TypesSupported值。

This should stop the "The description for Event ID...." message.

这应该会停止“事件 ID 的描述....”消息。

回答by Bruno Bieri

Restart your system!

重启你的系统！

A friend of mine had exactly the same problem. He tried all the described options but nothing seemed to work. After many studies, also of Microsoft's description, he concluded to restart the system. It worked!!

我的一个朋友遇到了完全相同的问题。他尝试了所有描述的选项，但似乎没有任何效果。经过多次研究，也是微软的描述，他得出结论，重新启动系统。有效！！

It seems that the operating system does not in all cases refresh the list of registered event sources. Only after a restart you can be sure the event sources are registered properly.

操作系统似乎不会在所有情况下都刷新已注册事件源的列表。只有在重新启动后，您才能确保事件源已正确注册。

回答by Alex

How about a real world solution.

现实世界的解决方案怎么样。

If all you need is a "quick and dirty" way to write something to the event logwithout registering "custom sources" (requires admin rights), or providing "message files" (requires work and headache) just do this:

如果您只需要一种“快速而肮脏”的方式来向事件日志写入内容，而无需注册“自定义源”（需要管理员权限）或提供“消息文件”（需要工作和头痛），请执行以下操作：

EventLog.WriteEntry(
    ".NET Runtime", //magic
    "Your error message goes here!!",
    EventLogEntryType.Warning,
    1000); //magic

This way you'll be writing to an existing "Application" log without the annoying "The description for Event ID 0 cannot be found"

通过这种方式，您将写入现有的“应用程序”日志，而不会出现烦人的“找不到事件 ID 0 的描述”

If you want the "magic" part explained I blogged about it here

如果你想解释“魔法”部分，我在这里写了博客

回答by Stefan Egli

You need to create an event source and a message file for it. Code looks something like this:

您需要为其创建事件源和消息文件。代码如下所示：

var data = new EventSourceCreationData("yourApp", "Application");
data.MessageResourceFile = pathToYourMessageFile;
EventLog.CreateEventSource(data);

Then you will need to create a message file. There is also this articlethat explains things (I did not read it all but it seems fairly complete).

然后您需要创建一个消息文件。还有这篇文章解释了一些事情（我没有阅读所有内容，但似乎相当完整）。

回答by Daniel Lidstr?m

Use PowerShell to create your event log and source:

使用 PowerShell 创建事件日志和源：

New-EventLog -LogName MyApplicationLog `
    -Source MySource `
    -MessageResourceFile C:\windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

You'll need the messages dll to avoid the problem you are seeing.

您将需要消息 dll 以避免出现您所看到的问题。

回答by Sonal

I also faced similar problem. After doing lot of research I did following I verified the steps according to this article http://www.codeproject.com/Articles/4166/Using-MC-exe-message-resources-and-the-NT-event-loEverything seemed to be in place. Except one thing..i realised it when I stumbled on this msdn http://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx

我也遇到了类似的问题。在做了大量研究之后，我按照这篇文章验证了步骤http://www.codeproject.com/Articles/4166/Using-MC-exe-message-resources-and-the-NT-event-loEverything似乎到位。除了一件事..当我偶然发现这个 msdn http://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx时我意识到了

As last paragraph says.. 'If the application calls RegisterEventSource and passes a source name that cannot be found in the registry, the event-logging service uses the Application log by default. However, because there are no message files, the Event Viewer cannot map any event identifiers or event categories to a description string, and will display an error. For this reason, you should add a unique event source to the registry for your application and specify a message file.'So my application name in RegisterEventSource was not matching with the application name in registry. I fixed this and now it works... So please double check your registry entries if you face this problem.

正如最后一段所说...... “如果应用程序调用 RegisterEventSource 并传递在注册表中找不到的源名称，则事件记录服务默认使用应用程序日志。但是，由于没有消息文件，事件查看器无法将任何事件标识符或事件类别映射到描述字符串，并且会显示错误。出于这个原因，您应该为您的应用程序向注册表添加一个唯一的事件源并指定一个消息文件。所以我在 RegisterEventSource 中的应用程序名称与注册表中的应用程序名称不匹配。我解决了这个问题，现在它可以工作了......所以如果你遇到这个问题，请仔细检查你的注册表项。

回答by Helder Magalh?es

I also stumbled on this - although caused by yet another possibility: the event identifier (which was "obfuscated" in a #define) was setting severityto error(the two high-order bits as stated in Event Identifiers). As Event Viewerdisplays the event identifier (the low-order 16 bits), there couldn't be a match...

我也偶然发现了这一点 - 尽管是由另一种可能性引起的：事件标识符（在 a 中被“混淆” #define）正在将严重性设置为错误（事件标识符中所述的两个高阶位）。由于事件查看器显示事件标识符（低 16 位），无法匹配...

For reference, I've put together a set of tips based in my own research while troubleshooting and fixing this:

作为参考，我在排查和解决此问题时根据自己的研究汇总了一组提示：

1. If your log entry doesn'tend with "the message resource is present but the message is not found in the string/message table" (as opposed to the original question):

   • Means that you're missing registry information
   • Double-check event source name and registry keys

2. If you need to add/edit registry information, remember to:

   • Restart Event Viewer(as stated in item 6 of KB166902and also by @JotaBe)
   • If it doesn't help, restart Windows Event Log/EventLogservice (or restart the system, as hinted by @BrunoBieri).

3. If you don'twish to create a custom DLL resource, mind that commonly available event message files have some caveats:

   • They hold a large array of identifiers which attempts to cover most cases
     • .NET EventLogMessages.dll(as hinted by @Matt) goes up to 0xFFFF
     • Windows EventCreate.exe"only" goes up to 0x3E9
   • Every entry contains %1
     • That means that only the firststring will be displayed
     • All strings passed to ReportEventcan still be inspected by looking into event details (select the desired event, go to Detailstab and expand EventData)

4. If you're stillgetting "cannot be found" in your logged events (original question):

   • Double-check event identifier valuesbeing used (in my case it was the Qualifierspart of the event identifier)
   • Compare event details (select the desired event, go to Detailstab and expand System) with a working example

1. 如果您的日志条目不以“存在消息资源但在字符串/消息表中找不到消息”结尾（与原始问题相反）：

   • 意味着您缺少注册表信息
   • 仔细检查事件源名称和注册表项

2. 如果您需要添加/编辑注册表信息，请记住：

   • 重新启动事件查看器（如KB166902 的第6项以及@JotaBe 所述）
   • 如果没有帮助，请重新启动Windows 事件日志/EventLog服务（或重新启动系统，如@BrunoBieri 所暗示的那样）。

3. 如果您不想创建自定义 DLL 资源，请注意常用的事件消息文件有一些警告：

   • 他们拥有大量的标识符，试图涵盖大多数情况
     • .NET EventLogMessages.dll（如@Matt 暗示的那样）上升到0xFFFF
     • Windows EventCreate.exe“仅”上升到0x3E9
   • 每个条目包含 %1
     • 这意味着只会显示第一个字符串
     • ReportEvent仍然可以通过查看事件详细信息来检查传递给的所有字符串（选择所需的事件，转到详细信息选项卡并展开EventData）

4. 如果您在记录的事件中仍然遇到“找不到”（原始问题）：

   • 仔细检查正在使用的事件标识符值（在我的情况下，它是事件标识符的限定符部分）
   • 将事件详细信息（选择所需事件，转到Details选项卡并展开System）与一个工作示例

回答by Johan Burman

For me, the problem was that my target profile by accident got set to ".Net Framework 4 Client profile". When I rebuilt the service in question using the ".Net Framework 4", the problem went away!

对我来说，问题是我的目标配置文件意外设置为“.Net Framework 4 客户端配置文件”。当我使用“.Net Framework 4”重建有问题的服务时，问题就消失了！

回答by JotaBe

If you open the Event Log viewer before the event source is created, for example while installing a service, you'll get that error message. You don't need to restart the OS: you simply have to close and open the event viewer.

如果您在创建事件源之前打开事件日志查看器，例如在安装服务时，您将收到该错误消息。您不需要重新启动操作系统：您只需关闭和打开事件查看器。

NOTE: I don't provide a custom messages file. The creation of the event source uses the default configuration, as shown on Matt's answer.

注意：我不提供自定义消息文件。事件源的创建使用默认配置，如 Matt's answer 所示。

回答by Stephen Cleary

This is usually caused by a program that writes into the event log and is then uninstalled or moved.

这通常是由写入事件日志然后被卸载或移动的程序引起的。