This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help.
Problem: I have a chain of loggers
CustomLogger (appends the log message with a custom EventId that gets parsed back out in NTEventLogAppender) --> slf4j --> log4j --> NTEventLogAppender
The log eventually gets consumed by the NTEventLogAppender which I've modified to parse the original message's appended EventID from the CustomLogger, and it works fine. However, when the message is generated with a custom EventID it says:
The description for Event ID (blah) in Source ( Order Station Jetty Server Diag ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: 111219 [main] INFO
I need to get rid of this canned message at the beginning of all of my custom logging messages.
I have edited the EventLogCategories.mc file to reflect all the new codes, like so:
; example of new logging code MessageId=0x45 Language=English No logging code was given, using default logging code %1 .
and am running the build.bat file which generates an NTEventLogAppender.dll file, which I then place in the appropriate directory and run regsvr32 on it.
I also looked at this FAQ from Apache, http://logging.apache.org/log4j/1.2/faq.html#a2.10, and copied the NTEventLogAppender.dll to the %SYSTEMROOT%\SYSTEM32 directory to no avail.
Furthermore I saw this, https://issues.apache.org/bugzilla/show_bug.cgi?id=37866, and then added the Microsoft Message Compiler (mc.exe) and MinGW to the system Path environment variable, recompiled, copied and registered... all to no avail.
Lastly I tried to post to the Apache Logging-log4j-user forum, (link redacted because I'm a new user and more than two links in a post are prohibited), but the email@example.com address just bounced back to me.
Anyone have any ideas where else I could be going wrong?