Description for event id from source cannot be found

Question

When I write a log into windows event log, I get the event below, what's the root cause of this message, and how can I fix it? Many Thanks

The description for Event ID 51001 from source RRWS cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

test log messge

the message resource is present but the message is not found in the string/message table

Swap

I got this error when trying to run a .NET 7.0 Windows Service using my current user account. Installing the application as a service and starting the service, created the registrations needed for the event logs to be created, without generating this error. I assume administrator permissions are required in order for .NET to register the event source in the registry. – Getup

Answer 1

I got this error after creating an event source under the Application Log from the command line using "EventCreate". This command creates a new key under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

If you look at the Key that's been created (e.g. SourceTest) there will be a string value calledEventMessageFile, which for me was set to %SystemRoot%\System32\EventCreate.exe.

Change this to c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

Delete theCustomSource and TypesSupported values.

This should stop the "The description for Event ID...." message.

Imprecision

I'd seen similar advice elsewhere, and have followed it, but to no avail. I still get the event id blurb... (I'm using event id 0, if that matters) – Beggarly

@Beggarly Not sure if it will make any difference, but we picked on 100 for the eventId and it worked ok. I guess the other thing to check would be the permissions? Although I'd have thought you'd get a different error message, but worth checking. – Imprecision

I'm afraid this didn't work for me, but instead I finally figured out how to compile my own Message File, and this worked a treat. – Beggarly

I'm running .NET 4.0.3 on Windows Server 2008 R2 (x64), so I used: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll – Amorphous

More information can be found at technet.microsoft.com/en-us/library/bb490899.aspx. – Snow

Answer 2

How about a real world solution.

If all you need is a "quick and dirty" way to write something to the event log without registering "custom sources" (requires admin rights), or providing "message files" (requires work and headache) just do this:

EventLog.WriteEntry(
    ".NET Runtime", //magic
    "Your error message goes here!!",
    EventLogEntryType.Warning,
    1000); //magic

This way you'll be writing to an existing "Application" log without the annoying "The description for Event ID 0 cannot be found"

If you want the "magic" part explained I blogged about it here

Ollieollis

TLDR: ".NET Runtime" is added by the runtime, and mscoree.dll defines some codes (how many?) starting with 1000 as placeholders. – Crinkle

I did not read the magical part, but all you are doing is writing to an existing Source (that being .NET Runtime). Some of us want to write to our own AppName as a source. – Ras

There is no .NET Runtime magic. The trick is not to specify the category parameter. Have a look: https://mcmap.net/q/120573/-description-for-event-id-from-source-cannot-be-found – Extravasation

Perfect for my needs, I just need to write some test messages to event viewer. – Rootstock

Working with the event log for years, doing custom logs, etc. still would have strange results. Ended up using .NET Runtime and that worked, but the 1000 is magic. That fixed it. – Orientation

Answer 3

Restart your system!

A friend of mine had exactly the same problem. He tried all the described options but nothing seemed to work. After many studies, also of Microsoft's description, he concluded to restart the system and it worked!!

It seems that the operating system does not in all cases refresh the list of registered event sources. Only after a restart you can be sure the event sources are registered properly.

Cyrano

This was the issue for me. What a waste of time trying to figure that one out. – Workwoman

Yeah, spend hours searching for weird issues and permissions with event forwarding and sysmon. Anyways rebooting all machines fixed it. – Wilmawilmar

Answer 4

You need to create an event source and a message file for it. Code looks something like this:

var data = new EventSourceCreationData("yourApp", "Application");
data.MessageResourceFile = pathToYourMessageFile;
EventLog.CreateEventSource(data);

Then you will need to create a message file. There is also this article that explains things (I did not read it all but it seems fairly complete).

Ing

I'm using the System.Diagnostics.TraceSource.TraceEvent Method and I'm getting the same error. Your Answer fixed that problem: But shouln't there be an easier solution for that? (Would get complicated with the IT-Guys to deploy that ;)) – Thomasenathomasin

My answer borrows the message file from .net, which seems to stop it complaining. This should be easier to deploy as it could all be done with a .reg file. It does not, however, give you the chance to customise it as much as creating your own message file. – Imprecision

Answer 5

Use PowerShell to create your event log and source:

New-EventLog -LogName MyApplicationLog `
    -Source MySource `
    -MessageResourceFile C:\windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

You'll need the messages dll to avoid the problem you are seeing.

Elora

For more info how to use see New-EventLog – Navar

Answer 6

I also stumbled on this - although caused by yet another possibility: the event identifier (which was "obfuscated" in a #define) was setting severity to error (the two high-order bits as stated in Event Identifiers). As Event Viewer displays the event identifier (the low-order 16 bits), there couldn't be a match...

For reference, I've put together a set of tips based in my own research while troubleshooting and fixing this:

1. If your log entry doesn't end with "the message resource is present but the message is not found in the string/message table" (as opposed to the original question):

   • Means that you're missing registry information
   • Double-check event source name and registry keys

2. If you need to add/edit registry information, remember to:

   • Restart Event Viewer (as stated in item 6 of KB166902 and also by @JotaBe)
   • If it doesn't help, restart Windows Event Log/EventLog service (or restart the system, as hinted by @BrunoBieri).

3. If you don't wish to create a custom DLL resource, mind that commonly available event message files have some caveats:

   • They hold a large array of identifiers which attempts to cover most cases
     • .NET EventLogMessages.dll (as hinted by @Matt) goes up to 0xFFFF
     • Windows EventCreate.exe "only" goes up to 0x3E9
   • Every entry contains %1
     • That means that only the first string will be displayed
     • All strings passed to ReportEvent can still be inspected by looking into event details (select the desired event, go to Details tab and expand EventData)

4. If you're still getting "cannot be found" in your logged events (original question):

   • Double-check event identifier values being used (in my case it was the Qualifiers part of the event identifier)
   • Compare event details (select the desired event, go to Details tab and expand System) with a working example

Talya

Thank you! I would not have thought that it was as simple as restarting Event Viewer (after restarting the Windows Event Log service). – Item

Answer 7

This is usually caused by a program that writes into the event log and is then uninstalled or moved.

Urbain

i had removed a service that did write in event logs, and i started receiving this error when i reinstalled it and tried to start it. can you suggest how to resolve this error? – Maxia

If you uninstalled and reinstalled, you might just need to reboot. – Urbain

reboot did not work! – Maxia

I recommend asking your own question, then. – Urbain

Answer 8

I also faced similar problem. After doing lot of research I did following I verified the steps according to this article http://www.codeproject.com/Articles/4166/Using-MC-exe-message-resources-and-the-NT-event-lo Everything seemed to be in place. Except one thing..i realised it when I stumbled on this msdn http://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx

As last paragraph says.. 'If the application calls RegisterEventSource and passes a source name that cannot be found in the registry, the event-logging service uses the Application log by default. However, because there are no message files, the Event Viewer cannot map any event identifiers or event categories to a description string, and will display an error. For this reason, you should add a unique event source to the registry for your application and specify a message file.' So my application name in RegisterEventSource was not matching with the application name in registry. I fixed this and now it works... So please double check your registry entries if you face this problem.

Salpingotomy

Answer 9

If you open the Event Log viewer before the event source is created, for example while installing a service, you'll get that error message. You don't need to restart the OS: you simply have to close and open the event viewer.

NOTE: I don't provide a custom messages file. The creation of the event source uses the default configuration, as shown on Matt's answer.

Success

So what you are suggesting is that the historical log of your events changes by closing and re-opening the log? I know you are wrong on this but in what world would you want to be right? The whole point of the event log is to log what events happened, not to re-write then afterwards. – Toughie

@Paul McCarthy: no, I'm not suggesting that. Forget what you know: I'm not wrong. As a developer, I know by my own experience that, if you create an event source while the viewer is already open, and you create a log entry on that source, if you try to see it, the viewer shows that error message. I guess that the viewer get the list of known event sources when opening, and doesn't refresh it, unless you restart it. Even more, as Bruno Bieri shows in his answer, it looks like on more severe cases you need to restart the system. In other words, it's on the log but the viewer can't understand it – Success

Answer 10

For me, the problem was that my target profile by accident got set to ".Net Framework 4 Client profile". When I rebuilt the service in question using the ".Net Framework 4", the problem went away!

Osteoid

Answer 11

Other aswers are helpful; I wanted to provide a details response for anyone who just discovered this issue. This was in reference to the issue above on Windows Server 2019.

1 - Try creating the source with code

The code should check for the source and create it if it does not already exist.

Sample code (powershell w/.NET):

$source = "MySource"

if (![System.Diagnostics.EventLog]::SourceExists($source)) {
    [System.Diagnostics.EventLog]::CreateEventSource($source, 'Application')
}

[System.Diagnostics.EventLog]::WriteEntry($source, 'log message test', [System.Diagnostics.EventLogEntryType]::Information)

2 - Reboot PC/Server

Unlikely to help but an easy option.

3 - EventCreate CMD tool

Try using the cmd line tool 'eventcreate' to write the entry, it may give you more detail into the problem:

eventcreate /T Information /ID 20 /L Application /SO PEI /D “Raymondcc Event for My Program"

Error:

eventcreate : ERROR: Source parameter is used to identify custom applications/scripts only (not installed applications).

which means you can't add to sources that weren't created by eventcreate. This means that the the source was created by an application during install etc. and you should not attempt to make this work and instead pick a new source name (or none at all)

4 - Verify registry

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application<source name>

Where it says replace with the source you are trying to use. If you see EventMessageFile set to something like C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll, then it's OK. If you see an application path like c:\program files\my program.exe, then it will not work.

5 - Other options

there are ways to work around this but it is complicated. Basically it is far better to just use another source name if at all possible. If the key isn't necessary you could duplicate it (e.g. dupicate Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application<source name>), then delete it and see if there are any issues from using eventcreate from then on.

Jinni

Answer 12

Improving on the answer by @Alex, I suggest the following:

            using (EventLog eventLog = new EventLog("Application"))
            {
                //You cannot be sure if the current identity has permissions to register the event source.
                try
                {
                    if (System.Web.HttpRuntime.AppDomainAppId != null)
                    {
                        eventLog.Source = System.Web.HttpRuntime.AppDomainAppId;
                    }
                    else
                    {
                        eventLog.Source = Process.GetCurrentProcess().ProcessName;
                    }
                }
                catch (SecurityException)
                {
                    eventLog.Source = "Application";
                }

                eventLog.WriteEntry("Log message example", EventLogEntryType.Information, 1000);
            }

It is important here not to specify category parameter. If you do, and this is the same for the .NET Runtime so-called magic, the

The description for Event ID <...> from source <...> cannot be found.

is going to appear.

Extravasation

I get The source was not found, but some or all event logs could not be searched. To create the source, you need permission to read all event logs to make sure that the new source name is unique. So you still need to register a source. Which is not an option for ASP.NET apps for example – Ollieollis

@Alex I updated the answer in order to get it more ASP.NET friendly. Anyway, I would suggest to register the EventSource for each of the app pools instead of using a preinstalled .NET Runtime source. – Extravasation

The eventLog.WriteEntry() should be within the catch, as the SecurityException is thrown when you attempt to write. – Fragile

And also - it does not work without the `'NET Runtime' magic (on my Win10, .NET 4.5 project), so... pretty much this answer is wrong, sorry. – Fragile

@Fragile I did not quite understand what you meant. Why would I want to put the eventLog.WriteEntry() into catch? Your second comment is also unclear. What does not work without what? – Extravasation

Sorry, I was unclear:) Of course I meant that the WriteEntry should be in the try part of the try-catch clause, because when the SecurityException happens, it is not handled by the catch in your snippet. That being said, your sample does not prevent the The description for Event ID 1000 from source <...> cannot be found. message from appearing - contrary to the answer with the '.NET Runtime' magic. – Fragile