Windows 事件 ID
Windows 中是否为应用程序开发人员保留了特定范围的事件 ID？
我正在开发一个 .Net 应用程序，该应用程序会将错误写入 Windows 事件日志。该应用程序实际上针对服务器，并将由偏执的系统管理员作为计划任务运行，他们希望尽可能地锁定它（包括使用降低权限的维护帐户运行它）。该应用程序不会正式安装 - 事实上，我什至没有为此构建安装程序；只是一个包含 .exe 和 app.config 文件的 zip 文件。
技巧如下：在 Windows 中，您需要管理员权限才能在应用程序事件日志中创建源。由于我不能指望这一点，并且我不想让劳累过度的系统管理员需要创建一个，因此我使用“应用程序错误”（由 MS Office 使用）作为后备。 （选择更好的后备方案已在我的待办事项列表中，因为服务器上安装的 Office 并不常见）。
问题是我仍然希望我的活动能够脱颖而出，而不仅仅是伪装成 Office。这样，我的系统管理员可以轻松过滤到事件查看器或他们选择的日志聚合器中的那些事件。我现在知道的最佳解决方案是使用事件 ID，但我担心与内部 Windows 事件发生冲突，特别是考虑到我的目标受众。
我看过了，但找不到任何关于此的文档。那么，我应该使用特定范围的事件 ID，我可以使用任何内容吗，或者我应该在这里考虑一个完全不同的选项？
Is there a specific range of Event IDs in Windows reserved for application developers?
I'm working on a .Net application that will write errors to the windows event log. This application actually targets servers, and will be run as a scheduled task by paranoid sys admins who will want to lock it down as much as possible (including running it with a reduced privilege maintenance account). The app will not be formally installed — in fact, I'm not even building an installer for this; just a zip file with the .exe and app.config file.
Here's the trick: in Windows, you need administrator privileges to create a source in the Application event log. Since I can't count on this and I don't want to make overworked sys admins need to create one, I'm using "Application Error" (used by MS Office) as a fallback. (Picking a better fallback is on my todo list, since office isn't as often installed on servers).
The problem is that I still want my events to stand out a bit, rather than just masquerading as Office. This way, my sys admins can easily filter down to just those events in Event Viewer or the log aggregator of their choice. The best solution I'm aware of right now is using the Event ID, but I'm worried about conflicting with internal Windows Events, especially considering my target audience.
I've looked, but I can't find any documentation on this. So, is there a specific range of Event IDs I should use, will I be okay using whatever, or should I look at a completely different option here?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
并不真地。在顶层，您有一个事件源。每个事件源都有自己的事件类别。每个事件消息均由事件源“拥有”，并属于其事件类别之一。如果您要将事件记录在其他人的事件源下，则您就违反了此约定，并且很可能会发生事件 ID 冲突。
另一方面，事件 ID 在结构上与 HRESULT 类似，并且有您可以设置的客户位。还有一个设施代码字段，但微软只为第三方提供一项设施（其余保留）。即使你弄乱了这些位，你仍然受到事件源所有者的摆布；如果 Microsoft 曾经向您正在使用的事件源写入某些内容并设置客户位或设施代码（例如可能是 Office 等非 Windows 组件），您将再次面临同样的冲突危险。或者如果其他开发人员决定做你正在做的同样的事情。实际上，最安全的方法是定义您自己的事件源。
Not really. At the top level you have an Event Source. Each Event Source has its own Event Categories. Each Event Message is "owned" by an Event Source and falls into one of its Event Categories. If you're going to be logging your events under someone else's Event Source, you're breaking this convention and could quite possibly have Event ID collisions.
On the other hand, Event IDs are structurally similar to HRESULTs and there is a Customer bit you could set. There is also a Facility Code field, but Microsoft only provides one facility for 3rd parties (the rest are reserved). Even if you mess with these bits, you are still at the mercy of the owner of the Event Source; if Microsoft were ever to write something to the Event Source you are using and set the Customer bit or Facility Code (e.g. perhaps non-Windows components such as Office or something), you would be right back in the same danger of collisions. Or if some other developer decides to do the same thing you are doing. Really the safest way is to define your own Event Source.
看来这才是问题的关键
我认为您不必担心，因为事件 ID 对应于特定的事件源，因此除非您使用完全相同的源，否则不会让管理员感到不安。例如，MS 有时会对不同的源使用相同的 ID。
如果您想获取有关注册发布者和事件 ID 的信息，可以使用 Wevtutil 例如，这将列出发布者。
从中您可以获取用于发布者的特定事件 ID，您可以使用以下内容（本例中使用了事件日志）
如果您擅长 powershell，我相信您可以想出一个脚本来获取所有事件已注册的 id
It seems this is the crux of the problem
I don't think you have to worry because the Event ID's correspond to a specific Event Source so unless you use the exact same source you won't cause the admin's to get upset. For example MS does sometimes uses the same ID with different sources.
If you want to get information about the registered publishers and event ids you can use Wevtutil For example this will list the publishers.
From that you can get the specific event ids used for a publisher you can use the following (Event Log was used in this example)
If you're good at powershell I'm sure you could come up with a script to get all the event ids that are registred