public override string ToString() { StringBuilder output = new StringBuilder(string.Empty); output.AppendFormat("Name: {0}|", Name); output.AppendFormat("EventLog: {0}|", LogName); if (EventMessageFiles.Any()) { output.AppendFormat("EventMessageFiles: {0}|", string.Join("; ", EventMessageFiles.ToArray().Select(f => f.FileName).ToArray()).Trim().TrimEnd(new char[] { ';' })); } if (!string.IsNullOrEmpty(CategoryMessageFile)) { output.AppendFormat("CategoryMessageFile: {0}|", CategoryMessageFile); } if (!string.IsNullOrEmpty(ParameterMessageFile)) { output.AppendFormat("ParameterMessageFile: {0}|", ParameterMessageFile); } if (ProviderGuid != Guid.Empty) { output.AppendFormat("ProviderGuid: {0}|", ProviderGuid); } if (EventLevels.Bitmask != long.MaxValue) { output.AppendFormat("EventLevels: {0}|", EventLevels); } if (CategoryCount != Int32.MaxValue) { output.AppendFormat("CategoryCount: {0}|", CategoryCount); } string s = output.ToString().Trim(); if (s.EndsWith("|", true, CultureInfo.CurrentCulture)) { s = s.TrimEnd(new char[] { '|' }); } return(s); }
/// <summary> /// Process all the entries in the EventMessageFile registry value. /// </summary> /// <param name="logName"></param> /// <param name="sourceName"></param> /// <param name="eventMessageFiles"></param> private void ProcessEventMessageFiles(string logName, string sourceName, string eventMessageFiles) { if (!string.IsNullOrEmpty(eventMessageFiles)) { string systemRootPath = Environment.GetEnvironmentVariable("systemroot").ToLower(CultureInfo.CurrentCulture); string winDirPath = Environment.GetEnvironmentVariable("windir").ToLower(CultureInfo.CurrentCulture); // fix up paths to be literal paths eventMessageFiles = eventMessageFiles.ToLower(CultureInfo.CurrentCulture); eventMessageFiles = eventMessageFiles.Replace("%systemroot%", systemRootPath); eventMessageFiles = eventMessageFiles.Replace(@"\systemroot", systemRootPath); eventMessageFiles = eventMessageFiles.Replace("%windir%", winDirPath); eventMessageFiles = eventMessageFiles.Replace("$(runtime.system32)", Environment.GetFolderPath(Environment.SpecialFolder.System)); //seen on Windows 8+ for WinHttpAutoProxySvc foreach (string messageFilePath in eventMessageFiles.Split(new string[] { ";" }, StringSplitOptions.RemoveEmptyEntries)) { // can't directly modify messageFilePath since it is part of the foreach string modifiedMessageFilePath = messageFilePath.Trim(); // some paths are missing a slash between %systemroot% and the rest of the path // one example is the EventMessageFile registry value for the Eventlog\System\vsmraid\ on Windows Vista // we do the same check for %windir% just to be safe if (modifiedMessageFilePath.StartsWith(systemRootPath, StringComparison.CurrentCultureIgnoreCase) && !modifiedMessageFilePath.StartsWith(systemRootPath + @"\", StringComparison.CurrentCultureIgnoreCase)) { modifiedMessageFilePath = modifiedMessageFilePath.Replace(systemRootPath, systemRootPath + @"\"); } if (modifiedMessageFilePath.StartsWith(winDirPath, StringComparison.CurrentCultureIgnoreCase) && !modifiedMessageFilePath.StartsWith(winDirPath + @"\", StringComparison.CurrentCultureIgnoreCase)) { modifiedMessageFilePath = modifiedMessageFilePath.Replace(winDirPath, winDirPath + @"\"); } // check to see if the messagefile has already been parsed // otherwise parse the messagefile and add it to the cache if (EventMessageFileCache.Instance.Contains(modifiedMessageFilePath)) { EventMessageFiles.Add(EventMessageFileCache.Instance.Get(modifiedMessageFilePath)); } else { string[] messageFilePaths = modifiedMessageFilePath.Split(new string[] { @"\" }, StringSplitOptions.RemoveEmptyEntries); if (messageFilePaths.Length > 0) { string file = messageFilePaths.Last(); if (!string.IsNullOrEmpty(file)) { EventMessageFile messageFile = new EventMessageFile(logName, sourceName, file, modifiedMessageFilePath); EventMessageFileCache.Instance.Add(messageFile); EventMessageFiles.Add(messageFile); } else { Logger.Debug(CultureInfo.CurrentCulture, "Message file name is empty '{0}'='{1}' for log '{2}' and source '{3}'", modifiedMessageFilePath, eventMessageFiles, logName, sourceName); } } else { Logger.Debug(CultureInfo.CurrentUICulture, "Message file path has no elements '{0}'='{1}' for log '{2}' and source '{3}'", modifiedMessageFilePath, eventMessageFiles, logName, sourceName); } } } } }