Article ID: 165959 - View products that this article applies to.
This article was previously published under Q165959
The Event Viewer enables the user to save the event logs in a binary file with the EVT extension. Such a file can be opened with the Event Viewer on any other computer running the same version of Windows NT.
Even though the Event Viewer is able to load such a file, it needs the messages DLLs for each component described in the source of the events.
For example, assume that computer A is running Windows NT 4.0 and a service called "aservice". On this computer, save the system event logs under the file System_A.evt. Now assume that computer B is also running Windows NT 4.0. The service "aservice" has not been installed on computer B.
On computer B, you open the file System_A.evt with the Event Viewer. If you double-click a message with the source set to "aservice," you get the following error:
Follow the steps in the next section to read the event logs of computer A while on computer B without having to install the components of computer A onto computer B.
The description for Event ID (xxx) in Source (aservice) could not be found. It contains the following insertion string(s): ...
The EVT files include the event log messages as they are stored by the system. Each message is composed of an ID (that is, the message itself) and a number of insertion strings. The IDs are translated into strings through the use of messages DLLs.
All the application event logs messages DLLs are defined under the following registry keys:
All the system event logs messages DLLs are defined under the following registry keys:
For example, the TCP/IP service's message DLL is defined under the following registry entry:
Key = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ System\TcpIp Value = EventMessageFile REG_EXPAND_SZ %SystemRoot%\System32\ netevent.d
Therefore, all the TCP/IP event log messages are defined in the DLL netevent.dll.
When the user double-clicks an event for which the message DLL is not defined in the registry, the message string cannot be displayed and the following message is displayed:
Below is a description of a way to read the system event logs of a computer with WINS on a computer without WINS. This sample can be adapted for any application or system component.
The description for Event ID (51) in Source (aservice) could not be found. It contains the following insertion string(s): ...
WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.
The following operations are required:
Article ID: 165959 - Last Review: November 1, 2006 - Revision: 1.1