Lazy Diary @ Hatena Blog

PowerShell / Java / miscellaneous things about software development, Tips & Gochas. CC BY-SA 4.0/Apache License 2.0

Record a Windows Event Log with a custom application/source and appropriate message


  • You want to record an event on Windows Event Log.
  • The log should be recorded with a custom application and source.
  • The message of the event should be recorded appropriately. The message should not contain the warning like The description for Event ID ( <####> ) in Source (<application name>) could not be found..

What you have to do

  1. Run the following command on PowerShell with administrator privilege. Note that you have to once register, remove, and re-register the event source with a custom log name. When you run Write-EventLog just after New-EventLog -LogName Application -Source MyLogSource, the message contained the warning above in my environment.
PS C:\> New-EventLog -LogName Application -Source MyLogSource
PS C:\> Remove-EventLog -Source MyLogSource
PS C:\> New-EventLog -LogName MyLogName -Source MyLogSource
  1. Run Write-EventLog with the ordinal user privilege.
PS C:\> Write-EventLog -LogName MyLogName -Source MyLogSource -EventID 1 -Category 0 -EntryType "Information" -Message "SOME MESSAGE"

Note (the location of events)

Note that New-EventLog adds a new entry [Application and Service Logs]-[MyLogName] on the Windows Event Viewer, but it will be empty. The Write-EventLog will add an event on [Windows Logs]-[Application]. The general information of the event will be like this:

Item Value
Log Name Application
Source MyLogSource
Event ID 1
Lelel Information
User N/A
OpCode Information
Task Category None*1
Keywords Classic
Computer (equals to the result of hostname)

Note (message table DLL and MUI files)

Some site *2*3 says you need to make a message table DLL with mc.exe, rc.exe, link.exe to suppress the message The description for Event ID ( <####> ) in Source (<application name>) could not be found. Some site also says you need MUI files for DLLs. In my environment, message table DLL doesn't work and New-EventLog solves the problem.