EventLog in Windows Server 2008
Hi, I am currently using Windows Server 2008. My application is trying to access the following registry keys but it is not present in the registry, HKLM\System\CurrentControlSet\Services\EventLog\System\Service Control Manager\EventMappingFile HKLM\System\CurrentControlSet\Services\EventLog\Security\Security The above registry keys are present in Windows Server 2003. I would like to know if there are any other alernate registry for the above 2 registries in WIndows Server 2008 or will the same registry be updated in future releases. Thanks in advance for ur help!!! Preethi
March 4th, 2008 10:31pm

I check with my windows 2003 server and I didn't see any entries like "EventMappingFile". However I do see a entry for "EventMappingFile". and the below registry key is available in my installation fo Windows 2008. HKLM\System\CurrentControlSet\Services\EventLog\Security\Security
Free Windows Admin Tool Kit Click here and download it now
March 10th, 2008 10:46pm

Hi, I agree with Santhosh. I also checked in my Windows server 2003 and I also didn't find the entry of "HKLM\System\CurrentControlSet\Services\EventLog\System\Service Control Manager\EventMappingFile". There is a registry value named EventMessageFile in the HKLM\System\CurrentControlSet\Services\EventLog\System\Service Control Manager registry key. Do you refer to this registry value? If not, I suspect some third-party applications create the entry of "EventMappingfile". As you know, we made a lot of changes in Windows Server 2008 event system. We do not have 1:1 mapping for event log related registry keys between Windows Server 2003 and Windows Server 2008. If you would like to find the corresponding DLL files for a Windows Server 2008 component, such as Failover Clustering, you may perform the following steps: 1.Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels, find the Log you want. 2.Copy down OwningPublisher. 3. Navigate to HKLM\software\microsoft\windows\currentversion\winevt\publishers, search on the GUID you just copy, you should find the MessageFileName and ResourceFileName registry values. I hope this helps. Morgan
March 11th, 2008 11:50am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics