The description for event XXX cannot be found

Feb 11, 2011 at 1:48 PM

Hi Trevor,

I have a problem with "EventLog" consumers: I am not able to write the InsertionStringTemplates in the event log. Whenever I generate the event, the associated consumer is triggered and it writes a row in the event log, but the description is always: "The description for Event ID ( 9898 ) in Source ( WCT Agent ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description".

The operating system is Windows 2003 Server R2 SP2, running in a VMware Virtual Machine.

The code is reported below:

$objEventFilter = New-WmiEventFilter –Name ExternalStorageAdded –Query "select * from __InstanceCreationEvent within 5 where TargetInstance isa 'win32_logicaldisk'"

$objEventConsumer = New-WmiEventConsumer –ConsumerType EventLog -EventId 9898 –Name ExternalStorageAdded –EventType Information -InsertionStringTemplates "External storage connected" -SourceName "WCT Agent"

New-WmiFilterToConsumerBinding –Filter $objEventFilter –Consumer $objEventConsumer

Could you give me any suggestions, please?

Coordinator
Feb 21, 2011 at 2:21 PM

Hello Marzio,

 

I've actually run into the same issue using the EventLog consumer. As of right now I don't have a solution for it, as it would require a little investigative work into the Windows Event Log.

As a work-around, you could create a simple VBscript or PowerShell script and call them using the ActiveScriptEventConsumer or the CommandLineEventConsumer, respectively.

Hope this helps!

 

Cheers,
Trevor

Feb 22, 2011 at 8:11 AM

Hi Trevor,

thank you for your answer. Unluckily I cannot run custom scripts on remote machines, since I am authorized only to make small changes in their configuration (I managed to classify the definition of event filters and consumers as small modifications). To install a custom script, I should assure the compliance with the company software validation process, but this is out of scope for my project.

I will use the "sourcename" as identifier in the event log, until the insertionstringtemplate works.

Best regards,

Marzio