Change Event Log Entry Source

NTDEV
1

Hello,

I write event log entries with IoWriteErrorLogEntry() to the system log. The problem is, that the event log entry source is “ACPI” and not my service name “BrCanDrv”.
I don’t understand why the source isn’t my service name. Is it possible to change the source in the INF file or the driver? I tried to define the EventName in the AddService directive but it doesn’t help.

My INF file:
;-------------- Service installation
[BrCanDrv_Device.NT.Services]
AddService = BrCanDrv,%SPSVCINST_ASSOCSERVICE%, BrCanDrv_Service_Inst, BrCanDrv_Eventlog_Inst,BrCanDrv

; -------------- BrCanDrv driver install sections
[BrCanDrv_Service_Inst]
DisplayName = %BrCanDrv.SVCDESC%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %12%\BrCanDrv.sys
LoadOrderGroup = Extended Base
AddReg = BrCanDrv_AddReg

[BrCanDrv_EventLog_Inst]
AddReg = BrCanDrv_Eventlog_AddReg

[BrCanDrv_Eventlog_AddReg]
HKR,EventMessageFile,0x00020000,“%%SystemRoot%%\System32\drivers\BrCanDrv.sys;%%SystemRoot%%\System32\IoLogMsg.dll”
HKR,TypesSupported,0x00010001,7

2

What device object are you providing to event logging functions?

Ensure it is yours and not the lower one.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

<manuel.parfant> wrote in message news:xxxxx@ntdev…
> Hello,
>
> I write event log entries with IoWriteErrorLogEntry() to the system log. The problem is, that the event log entry source is “ACPI” and not my service name “BrCanDrv”.
> I don’t understand why the source isn’t my service name. Is it possible to change the source in the INF file or the driver? I tried to define the EventName in the AddService directive but it doesn’t help.
>
> My INF file:
> ;-------------- Service installation
> [BrCanDrv_Device.NT.Services]
> AddService = BrCanDrv,%SPSVCINST_ASSOCSERVICE%, BrCanDrv_Service_Inst, BrCanDrv_Eventlog_Inst,BrCanDrv
>
>
> ; -------------- BrCanDrv driver install sections
> [BrCanDrv_Service_Inst]
> DisplayName = %BrCanDrv.SVCDESC%
> ServiceType = 1 ; SERVICE_KERNEL_DRIVER
> StartType = 3 ; SERVICE_DEMAND_START
> ErrorControl = 1 ; SERVICE_ERROR_NORMAL
> ServiceBinary = %12%\BrCanDrv.sys
> LoadOrderGroup = Extended Base
> AddReg = BrCanDrv_AddReg
>
> [BrCanDrv_EventLog_Inst]
> AddReg = BrCanDrv_Eventlog_AddReg
>
> [BrCanDrv_Eventlog_AddReg]
> HKR,EventMessageFile,0x00020000,“%%SystemRoot%%\System32\drivers\BrCanDrv.sys;%%SystemRoot%%\System32\IoLogMsg.dll”
> HKR,TypesSupported,0x00010001,7
>
></manuel.parfant>

3

Thank you for your answer. You are right, it was the wrong device object.
I used WdfDeviceWdmGetPhysicalDevice() instead of WdfDeviceWdmGetDeviceObject() because of a typing error…
Now it works, thank you for your help!