Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help.

Problem: I have a chain of loggers

CustomLogger (appends the log message with a custom EventId that gets parsed back out in NTEventLogAppender) --> slf4j --> log4j --> NTEventLogAppender

The log eventually gets consumed by the NTEventLogAppender which I've modified to parse the original message's appended EventID from the CustomLogger, and it works fine. However, when the message is generated with a custom EventID it says:

The description for Event ID (blah) in Source ( Order Station Jetty Server Diag ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: 111219 [main] INFO

I need to get rid of this canned message at the beginning of all of my custom logging messages.

I have edited the file to reflect all the new codes, like so:

; example of new logging code
No logging code was given, using default logging code %1

and am running the build.bat file which generates an NTEventLogAppender.dll file, which I then place in the appropriate directory and run regsvr32 on it.

I also looked at this FAQ from Apache,, and copied the NTEventLogAppender.dll to the %SYSTEMROOT%\SYSTEM32 directory to no avail.

Furthermore I saw this,, and then added the Microsoft Message Compiler (mc.exe) and MinGW to the system Path environment variable, recompiled, copied and registered... all to no avail.

Lastly I tried to post to the Apache Logging-log4j-user forum, (link redacted because I'm a new user and more than two links in a post are prohibited), but the address just bounced back to me.

Anyone have any ideas where else I could be going wrong?

share|improve this question
up vote 0 down vote accepted

Solution: Delete the keys in the registry for the project's NTEventLogAppender, then run build.bat from the VS2010 command line interface, and copy the NTEventLogAppender to the appropriate location in the project folder.

No need to involve mc.exe or rc.exe, no need to copy to the \System32 directory.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.