0

I have a Microsoft.Diagnostics.Tracking.EventSource using Channel = EventChannel.Admin: the resulting manifest installs and works fine on the two W7 machines I've tried, but on 2008 R2, when I drill down in EventViewer, I get MMC snap-in errors, and I can see that the events are not 'recognised' ("The description blabla cannot be found...").

Strangely, if I uninstall the manifest, EventViewer can open the event file without exceptions (though still doesn't find the descriptions properly).

Is there something OS-specific about EventSource manifest files?

Any pointers of directions in which I should search?

Benjol
  • 63,995
  • 54
  • 186
  • 268

2 Answers2

2

The key question here is how you registered the manifest. Note that Event Viewer doesn't actually know how to read a manifest. When you use wevtutil to register a manifest, it mainly just adds registry keys. The registry keys are supposed to have the full path to a DLL, and the DLL is supposed to contain the compiled manifest data. If you didn't add the compiled manifest data to the DLL, or if you didn't provide the full path to the DLL when you registered the manifest, Event Viewer won't be able to find the data it needs.

Past versions of wevtutil haven't been very good about warning you when you do this incorrectly. I think newer versions (e.g. Windows 10) are getting better about it.

Doug Cook - MSFT
  • 121
  • 6
  • The problem is, that I'm pretty sure I did provide the necessary data etc. I guess I could start by checking in the registry, but from there... The manifest is the one generated automagically by `Microsoft.Diagnostics.Tracing` – Benjol Jun 03 '16 at 12:33
  • I meant, what command did you use to register your manifest? I assume you used wevtutil.exe. Did you compile the manifest, link the resulting resources into your DLL, and include the full path to that DLL in your wevtutil.exe command line? – Doug Cook - MSFT Jun 03 '16 at 23:35
  • `"%windir%\System32\wevtutil.exe" im "%~dp0Manifest.man" /rf:"%~dp0Manifest.dll" /mf:"%~dp0Manifest.dll""` – Benjol Jun 06 '16 at 04:48
  • Unfortunately, I don't know why this isn't working for you. Assuming your DLL has the appropriate resources compiled into it (a "WEVT_TEMPLATE" resource containing the event decoding information and an "11" resource containing the strings), and it is in the location where you said it would be (i.e. assuming the DLL is present in the location where the batch file was running), and assuming the Event Viewer tool has permissions to access that directory, it should work. Unfortunately, I can't guess what the problem would be. – Doug Cook - MSFT Jun 09 '16 at 23:42
  • Thanks for trying. I'm also trying another approach (http://stackoverflow.com/questions/37658444/why-is-vs-giving-me-disassembly-when-i-have-the-net-debug-symbols) – Benjol Jun 10 '16 at 04:43
0

User error, for a change :(

I even wrote it out right in the comment on Doug's answer: 

"%windir%\System32\wevtutil.exe" im "%~dp0Manifest.man"
           /rf:"%~dp0Manifest.dll" /mf:"%~dp0Manifest.dll"

But that wasn't what I actually had in my batch file, where I forgot to put the full path in front of the .man file name.

Benjol
  • 63,995
  • 54
  • 186
  • 268