I’m currently trying to log data to the Windows Event Viewer, and I’m trying to achieve something like this using C:
As you can see below, the General
tab contains the main text of my log, and the Details
tab contains more XML data. However, nothing I try online seems to be able to do that.
I’ve followed Microsoft documentation and wrote an .mc
file.
MessageIdTypedef=DWORD
SeverityNames=(Informational=0x1:STATUS_SEVERITY_INFORMATIONAL)
FacilityNames=(System=0x0FF
Application=0xFFF)
LanguageNames=(English=0x409:MSG00409)
MessageId=0x111
Severity=Informational
Facility=Application
SymbolicName=MSG_CMD_EXEC
Language=English
Command executed: %1.
Path: %2.
.
And here’s my current C code that’s is only able to modify the General Tab
.
HANDLE event_source = RegisterEventSource(NULL, "CommandLine");
if (event_source == NULL)
{
fprintf(stderr, "u26A0uFE0F Failed to log event: could not register the event source.n");
return;
}
// Write param to general event viewer tab
char* params[2];
params[0] = "cd";
params[1] = "<Data Name='path'>/usr/bin</Data>";
if (!ReportEvent(event_source, EVENTLOG_INFORMATION_TYPE, 0, MSG_CMD_EXEC, NULL, 2, 0, params, NULL))
{
fprintf(stderr, "Failed to log event: ReportEvent() failed with status %d.n", GetLastError());
}
DeregisterEventSource(event_source);
Is there a way to change that? Thanks!