保存可执行文件句柄的 Windows 事件日志服务
我有一个服务应用程序，在启动和关闭时记录事件日志记录。
我经常重建应用程序，然后重建主机上的可执行文件。问题是，在我的服务关闭后，Windows 事件日志服务（而不是事件日志查看器）持有可执行文件的打开句柄，因此我无法更新它。
我将事件日志消息嵌入到可执行文件中，我可以将其移出，但随后我只需将更新问题移至另一个文件。
我已仔细检查，并已正确配对 ::RegisterEventSource/::DeregisterEventSource。
有人遇到过这个问题吗？
I have a service application that on startup and shutdown logs an event log record.
I rebuild the application frequently and also then the executable on the host machine. And here is the problem, after my service shutdown the Windows Eventlog service (not the event log viewer) is holding an open handle to the executable so I cant update it.
I have the event log messages embedded in the executable, i could move it out but then I just move the update problem to another file.
I've double checked and I have paired ::RegisterEventSource/::DeregisterEventSource correctly.
Anyone encountered this problem ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我也遇到过这个问题，所以补充一下我的一些经验。
我有一个 Windows 2008 服务系统（在 2003 Server 上没有见过这个），当我停止服务时，svchost.exe 实例会加载服务可执行文件（使用 vmmap.exe 或 Process Hacker 可见），防止它被删除/在卸载/安装期间被覆盖。 svchost.exe 实例正在运行 DHCP 客户端 (Dhcp)、TCP/IP NetBIOS Helper (lmhosts) 和 Windows 事件日志 (EventLog) 服务。
在我们的例子中，我们创建了一个注册表项，使我们的服务可执行成为事件源。 （尽管我不确定我们为什么要这样做，或者我们是否应该这样做）。
根据经验，如果我在停止服务之前删除该注册表项，则 svchost.exe 不会加载可执行文件，一切都很好。如果服务已停止并且可执行文件已由 svchost.exe 加载，则重新启动事件日志服务（或终止进程）也会释放可执行文件。
我猜测我们的服务表现不佳（可能是 64 位操作系统上的 32 位进程的副作用？）或未正确安装，但尚未隔离问题。
更新：这个问题似乎只发生在 HP 系统上（而不是 Dell 或 IBM），这很奇怪。安装了 HP 特定的管理组件，因此也许其中之一正在以某种方式改变行为？
I've also run into this issue, so just adding some of my experiences.
I have a Windows 2008 Service system (have not seen this on 2003 Server), and when I stop my service, and instance of svchost.exe loads the service executable (visible using vmmap.exe or Process Hacker) preventing it from being deleted/overwritten during uninstall/install. The instance of svchost.exe is running the DHCP Client (Dhcp), TCP/IP NetBIOS Helper (lmhosts), and Windows Event Log (EventLog) services.
In our case, we have created a registry entry to make our service executable an event source. (though I'm unsure exactly why we are doing this, or whether we should be doing this).
Empirically, if I remove that registry entry before stopping the service, the executable is not loaded by svchost.exe and all is fine. If the service has already been stopped and executable loaded by svchost.exe, restarting the Event Log service (or killing the process) also frees up the executable.
I'm guessing our service is not well-behaved (perhaps a side effect of being a 32-bit process on 64-bit OS?) or correctly installed, but haven't isolated the issue yet.
Update: It appears this issue is only happening on HP systems (and not Dell or IBM) which is curious. There are HP-specific management components installed, so perhaps one of them is altering the behavior somehow?
我也遇到过这个问题。就我而言，nxlog 服务读取日志。只需在替换事件源文件之前停止 nxlog 服务即可。
I've also run into this issue. In my case, nxlog service reading logs. Simply stop nxlog service before replace event source file.
我认为这可能是事件日志查看者。关闭查看器就可以了。
I think it is probably the event log viewer. Close the viewer and you'll be fine.