Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

The description string for parameter reference (%1) could not be found

I'm getting this exception when trying to read from the Windows Log using C#'s method EventRecord.FormatDescription():

System.Diagnostics.Eventing.Reader.EventLogException: The description string for parameter reference (%1) could not be found
   at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, EvtFormatMessageFlags flag)
   at System.Diagnostics.Eventing.Reader.ProviderMetadataCachedInformation.GetFormatDescription(String ProviderName, EventLogHandle eventHandle)

The exception happens when the text of the event contains the string %% followed by a long number (some events from a source I don't control contain that pattern). Those %% are intended to be just text, I don't expect any parsing intelligence from Windows at that point.

Do you know what I can do to avoid .Net from throwing this error when the text of an event contains that pattern?

Here are the PowerShell commands that will cause the exception next time you try to read the event from a C# program:

New-EventLog -LogName Application -Source MyApp
Write-EventLog -Source MyApp -LogName Application -Message "%%4294967295" -EventId 3
like image 739
Daniel Avatar asked Feb 02 '26 23:02

Daniel


1 Answers

The workaround I ended up implementing is as follows:

    private string FormatEventDescription(EventRecord eventRecord)
    {
        try
        {
            return eventRecord.FormatDescription();
        }
        catch (EventLogException e)
        {
            return eventRecord.ToXml();
        }
    }

This is less than satisfactory, as that XML is not user-friendly, but at least it has all the information needed in case we need to know the original content of the EventRecord. Note the XML doesn't necessarily contain the description string inside, sometimes these events have a list of parameters which are used to fill a message template to generate the description string, so in this case you'll get the raw params.

like image 168
Daniel Avatar answered Feb 04 '26 12:02

Daniel