EventID value not set properly in LogEntry

Topics: Enterprise Library Core, Logging Application Block
Jul 10, 2007 at 1:25 AM
Hi,

I have a web application that fires events which get logged to a MSMQ where they picked up by MSMQ Distributors and written to local event logs. I am having an issue where the web application sets the EventID property in LogEntry as anything between 4000 and 7000 but the distributors have event id set to 1 at all times. When I look at the event logs in event viewer the event id is always 6352.

Does anyone know why even though I set my Event ID in LogEntry as between 4000 and 7000 the distributors pick up different values? And why does the event viewer report another value as well?

The odd thing is that the Message string has all the right values so I am thinking of writing a filter to correct all the values in the LogEntry at the distributors so the event logs have the right values but I have a feeling I am going about this the wrong way.

Thanks!!
- John
Jul 10, 2007 at 4:38 PM
BTW, here is the config entry for my TextFormatter:

<add template="Timestamp: {timestamp}&#xD;&#xA;Message: {message}&#xD;&#xA;Category: {category}&#xD;&#xA;Priority: {priority}&#xD;&#xA;EventId: {eventid}&#xD;&#xA;Severity: {severity}&#xD;&#xA;Title:{title}&#xD;&#xA;Machine: {machine}&#xD;&#xA;Application Domain: {appDomain}&#xD;&#xA;Process Id: {processId}&#xD;&#xA;Process Name: {processName}&#xD;&#xA;Win32 Thread Id: {win32ThreadId}&#xD;&#xA;Thread Name: {threadName}&#xD;&#xA;Extended Properties: {dictionary({key} - {value}&#xD;&#xA;)}"
type="Microsoft.Practices.EnterpriseLibrary.Logging.Formatters.TextFormatter, Microsoft.Practices.EnterpriseLibrary.Logging, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null"
name="Text Formatter" />

Is this the source of my problems with my event id values?
Jul 10, 2007 at 7:01 PM
Hi John,

I did a quick repro and it seemed to work fine (i.e. messages went through the queue and got picked up by the distributor service, which in turn wrote them to the event log).

Event ID 6352 is used to report logging failures, either on the client or on the distributor. What machine do the entries with this ID belong to? The information on the entry should give you some insight on what went wrong. Is the queue properly set up and configured on both the client and the distributor?

You mention that "the distrubutors have event id set to 1 at all times". What do you mean by that? What are "the distributors"?

Regards,
Fernando
Jul 10, 2007 at 7:15 PM
I think I am definately missing something because my event logs show errors on writing to the log

Here is one of the log entries I have:



Event Type: Error
Event Source: Enterprise Library Logging
Event Category: None
Event ID: 6352
Date: 7/10/2007
Time: 1:59:19 PM
User: N/A
Computer: NYCMJFRAN1-DEV
Description:
Timestamp: 7/10/2007 5:59:19 PM
Message: There is no explicit mapping for the categories 'Critical, Second Category, Third Category'. The log entry was:
Timestamp: 7/10/2007 1:59:18 PM
Message: Schema not found
Category: Critical, Second Category, Third Category
Priority: -1
EventId: 6000
Severity: Information
Title:633200183583125000
Machine: NYCMJFRAN1-DEV
App Domain: /LM/W3SVC/1/Root/MSMQTest-1-128285639579531250
ProcessId: 5616
Process Name: c:\windows\system32\inetsrv\w3wp.exe
Thread Name:
Win32 ThreadId:5988
Extended Properties: ClientErrorReference - 633200183583125000

Category:
Priority: -1
EventId: 6352
Severity: Error
Title:
Machine: NYCMJFRAN1-DEV
Application Domain: MsmqDistributor.vshost.exe
Process Id: 6004
Process Name: C:\Program Files\Microsoft Enterprise Library January 2006\src\Logging\MsmqDistributor\bin\Debug\MsmqDistributor.vshost.exe
Win32 Thread Id: 5776
Thread Name:
Extended Properties:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Do I need to add all my categories in the config file??? Thats the problem I see is this event entry.

I meant the MSMQ Distributor service application that comes with Enterprise Library.
Jul 10, 2007 at 7:24 PM
Hi John,

This message is stating that the configuration on your distributor is incomplete, as it's getting entries with categories it doesn't know about. You need to make sure the categories in the original log entry are available on the distributor's configuration, or the "all events" source is configured (i.e. there are trace listeners attached to it).

Regards,
Fernando
Jul 10, 2007 at 8:59 PM
Edited Jul 10, 2007 at 9:12 PM
Okay, adding the trace listener reference removed the "no explicit mapping for categories..." error but my event id value is still wrong. It should be between 4000 and 7000 but it is still returning 1. The message string contains the actual event though.

Event Type: Information
Event Source: Enterprise Library Logging
Event Category: None
Event ID: 1
Date: 7/10/2007
Time: 3:18:56 PM
User: N/A
Computer: NYCMJFRAN1-DEV
Description:
Timestamp: 7/10/2007 7:18:55 PM
Message: Timestamp: 7/10/2007 3:18:55 PM
Message: ReutersKnowledge.Web.Services.RkapiException: Unable to find companyid R=SLKJsLKJDLKJSlkajdslkjadk
Category: DataSource
Priority: -1
EventId: 5999
Severity: Error
Title:633214919357812500
Machine: NYCMJFRAN1-DEV
App Domain: /LM/W3SVC/1/Root/MSMQTest-2-128285679096562500
ProcessId: 4144
Process Name: c:\windows\system32\inetsrv\w3wp.exe
Thread Name:
Win32 ThreadId:5908
Extended Properties: ClientErrorReference - 633214919357812500
ServiceUser - rkapiserviceuser3@reuters.com
EffectiveUser - rkapiserviceuser3@reuters.com

Category: DataSource
Priority: -1
EventId: 1
Severity: Information
Title:
Machine: NYCMJFRAN1-DEV
Application Domain: /LM/W3SVC/1/Root/MSMQTest-2-128285679096562500
Process Id: 4144
Process Name: c:\windows\system32\inetsrv\w3wp.exe
Win32 Thread Id: 5908
Thread Name:
Extended Properties:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Jul 10, 2007 at 10:33 PM
Hi John,

This is strange. It worked for me, but I was using a single machine setup and IIS 5 on windows XP. Can you try your repro on a single machine?



Event Type: Information
Event Source: Enterprise Library Logging
Event Category: None
Event ID: 5555
Date: 7/10/2007
Time: 6:27:36 PM
User: N/A
Computer: FDS-D620
Description:
Timestamp: 7/10/2007 9:27:36 PM
Message: error message
Category: General
Priority: 10
EventId: 5555
Severity: Information
Title:
Machine: FDS-D620
App Domain: /LM/W3SVC/1/Root/repro-1-128285764259375000
ProcessId: 4160
Process Name: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
Thread Name:
Win32 ThreadId:6864
Extended Properties:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.