I'm getting this exception when trying to read from the Windows Log using C#'s method EventRecord.FormatDescription():
System.Diagnostics.Eventing.Reader.EventLogException: The description string for parameter reference (%1) could not be found
at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, EvtFormatMessageFlags flag)
at System.Diagnostics.Eventing.Reader.ProviderMetadataCachedInformation.GetFormatDescription(String ProviderName, EventLogHandle eventHandle)
The exception happens when the text of the event contains the string %% followed by a long number (some events from a source I don't control contain that pattern). Those %% are intended to be just text, I don't expect any parsing intelligence from Windows at that point.
Do you know what I can do to avoid .Net from throwing this error when the text of an event contains that pattern?
Here are the PowerShell commands that will cause the exception next time you try to read the event from a C# program:
New-EventLog -LogName Application -Source MyApp
Write-EventLog -Source MyApp -LogName Application -Message "%%4294967295" -EventId 3
The workaround I ended up implementing is as follows:
private string FormatEventDescription(EventRecord eventRecord)
{
try
{
return eventRecord.FormatDescription();
}
catch (EventLogException e)
{
return eventRecord.ToXml();
}
}
This is less than satisfactory, as that XML is not user-friendly, but at least it has all the information needed in case we need to know the original content of the EventRecord. Note the XML doesn't necessarily contain the description string inside, sometimes these events have a list of parameters which are used to fill a message template to generate the description string, so in this case you'll get the raw params.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With