EventLog control



Larry Waibel
07-09-2005, 10:25 PM
I'm using the EventLog component in my configuration. I wanted to limit the
logs to 64K and have them overwrite as needed. In the Target Designer in the
EventLog component Registry Data, I changed the entries. But when I build
and deploy and look at the registry entries on the target system they aren't
what I set them to in the component. How do I control the EventLog without
having the EventLog viewer on the target (including it bumps my usage from
60MB to 160MB and I can't afford that). Thanks!

KM
07-09-2005, 10:25 PM
Larry,

> I'm using the EventLog component in my configuration. I wanted to limit
> the
> logs to 64K and have them overwrite as needed. In the Target Designer in
> the
> EventLog component Registry Data, I changed the entries. But when I build
> and deploy and look at the registry entries on the target system they
> aren't

Are those getting overwritten at build time or during FBA? (open pre-FBA
image system hive and explore the settings under EventLog key)

> what I set them to in the component. How do I control the EventLog
> without
> having the EventLog viewer on the target (including it bumps my usage from
> 60MB to 160MB and I can't afford that).

Just add "Event Log" component and it will bring in the event logging
functionality. Don't add the heavy "Administration Support Tools" which
includes the Event Viewer (the exe).

KM

Larry Waibel
07-09-2005, 10:25 PM
How do I "open pre-FBA image system hive and explore the settings under
EventLog key"?

In article <ecEY86aYFHA.3864@TK2MSFTNGP10.phx.gbl>, Km wrote:
> From: "KM" <konstmor@nospam_yahoo.com>
> Subject: Re: EventLog control
> Date: Wed, 25 May 2005 21:52:36 -0700
> Newsgroups: microsoft.public.windowsxp.embedded
>
> Larry,
>
> > I'm using the EventLog component in my configuration. I wanted to limit
> > the
> > logs to 64K and have them overwrite as needed. In the Target Designer in
> > the
> > EventLog component Registry Data, I changed the entries. But when I build
> > and deploy and look at the registry entries on the target system they
> > aren't
>
> Are those getting overwritten at build time or during FBA? (open pre-FBA
> image system hive and explore the settings under EventLog key)
>
> > what I set them to in the component. How do I control the EventLog
> > without
> > having the EventLog viewer on the target (including it bumps my usage from
> > 60MB to 160MB and I can't afford that).
>
> Just add "Event Log" component and it will bring in the event logging
> functionality. Don't add the heavy "Administration Support Tools" which
> includes the Event Viewer (the exe).
>
> KM
>

Larry Waibel
07-09-2005, 10:25 PM
Okay, I figured out how to load the hive from my XP build and look at it with
regedit. The values in there are as I set them in TD which is what I want.
So something is happening later to change them. There's an entry toward the
end of the FBA log that says 'replacing system hives' but that's about all I
see. How do I determine what's changing the values?

In article <ecEY86aYFHA.3864@TK2MSFTNGP10.phx.gbl>, Km wrote:
> From: "KM" <konstmor@nospam_yahoo.com>
> Subject: Re: EventLog control
> Date: Wed, 25 May 2005 21:52:36 -0700
> Newsgroups: microsoft.public.windowsxp.embedded
>
> Larry,
>
> > I'm using the EventLog component in my configuration. I wanted to limit
> > the
> > logs to 64K and have them overwrite as needed. In the Target Designer in
> > the
> > EventLog component Registry Data, I changed the entries. But when I build
> > and deploy and look at the registry entries on the target system they
> > aren't
>
> Are those getting overwritten at build time or during FBA? (open pre-FBA
> image system hive and explore the settings under EventLog key)
>
> > what I set them to in the component. How do I control the EventLog
> > without
> > having the EventLog viewer on the target (including it bumps my usage from
> > 60MB to 160MB and I can't afford that).
>
> Just add "Event Log" component and it will bring in the event logging
> functionality. Don't add the heavy "Administration Support Tools" which
> includes the Event Viewer (the exe).
>
> KM
>

KM
07-09-2005, 10:25 PM
Larry,

> Okay, I figured out how to load the hive from my XP build and look at it
> with
> regedit.

Good.

> The values in there are as I set them in TD which is what I want.

Perfect. Now we know that it is some component that changes the values
during FBA.

> So something is happening later to change them. There's an entry toward
> the
> end of the FBA log that says 'replacing system hives' but that's about all
> I see.

This is required FBA step and it is not relevant to the issue.

> How do I determine what's changing the values?

That may be hard to find out. At least very labourous. You can put some
generic FBA commands to call CMD at diffenret FBA phases. The FBA should
wait until you close CMD window. In CMD you call to regedit and check out
the reg.value. This way you would know at what FBA phase the value gets
changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
key to see what FBA command is run at that phase.

Another way could be in creating a reg.monitoring app that would be launched
early to watch on when values are changed at particular registry branch and
log the changes. This way you again know when the value was changed.

It may be just easier to change the reg.values at the end of FBA (either
through very late FBA command or through StartUp item if you have Explorer
Shell).

KM

> In article <ecEY86aYFHA.3864@TK2MSFTNGP10.phx.gbl>, Km wrote:
>> From: "KM" <konstmor@nospam_yahoo.com>
>> Subject: Re: EventLog control
>> Date: Wed, 25 May 2005 21:52:36 -0700
>> Newsgroups: microsoft.public.windowsxp.embedded
>>
>> Larry,
>>
>> > I'm using the EventLog component in my configuration. I wanted to
>> > limit
>> > the
>> > logs to 64K and have them overwrite as needed. In the Target Designer
>> > in
>> > the
>> > EventLog component Registry Data, I changed the entries. But when I
>> > build
>> > and deploy and look at the registry entries on the target system they
>> > aren't
>>
>> Are those getting overwritten at build time or during FBA? (open pre-FBA
>> image system hive and explore the settings under EventLog key)
>>
>> > what I set them to in the component. How do I control the EventLog
>> > without
>> > having the EventLog viewer on the target (including it bumps my usage
>> > from
>> > 60MB to 160MB and I can't afford that).
>>
>> Just add "Event Log" component and it will bring in the event logging
>> functionality. Don't add the heavy "Administration Support Tools" which
>> includes the Event Viewer (the exe).
>>
>> KM
>>
>
>

Larry Waibel
07-09-2005, 10:25 PM
I'd hoped it would have been easier to find than that :-) Guess since I have
an application that starts up each boot I'll just have it set the registry
values. I just hate not knowing what's going on!

In article <OHv$AUiYFHA.712@TK2MSFTNGP14.phx.gbl>, Km wrote:
> From: "KM" <konstmor@nospam_yahoo.com>
> Subject: Re: EventLog control
> Date: Thu, 26 May 2005 11:59:15 -0700
> Newsgroups: microsoft.public.windowsxp.embedded
>
> Larry,
>
> > Okay, I figured out how to load the hive from my XP build and look at it
> > with
> > regedit.
>
> Good.
>
> > The values in there are as I set them in TD which is what I want.
>
> Perfect. Now we know that it is some component that changes the values
> during FBA.
>
> > So something is happening later to change them. There's an entry toward
> > the
> > end of the FBA log that says 'replacing system hives' but that's about all
> > I see.
>
> This is required FBA step and it is not relevant to the issue.
>
> > How do I determine what's changing the values?
>
> That may be hard to find out. At least very labourous. You can put some
> generic FBA commands to call CMD at diffenret FBA phases. The FBA should
> wait until you close CMD window. In CMD you call to regedit and check out
> the reg.value. This way you would know at what FBA phase the value gets
> changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
> key to see what FBA command is run at that phase.
>
> Another way could be in creating a reg.monitoring app that would be launched
> early to watch on when values are changed at particular registry branch and
> log the changes. This way you again know when the value was changed.
>
> It may be just easier to change the reg.values at the end of FBA (either
> through very late FBA command or through StartUp item if you have Explorer
> Shell).
>
> KM
>
> > In article <ecEY86aYFHA.3864@TK2MSFTNGP10.phx.gbl>, Km wrote:
> >> From: "KM" <konstmor@nospam_yahoo.com>
> >> Subject: Re: EventLog control
> >> Date: Wed, 25 May 2005 21:52:36 -0700
> >> Newsgroups: microsoft.public.windowsxp.embedded
> >>
> >> Larry,
> >>
> >> > I'm using the EventLog component in my configuration. I wanted to
> >> > limit
> >> > the
> >> > logs to 64K and have them overwrite as needed. In the Target Designer
> >> > in
> >> > the
> >> > EventLog component Registry Data, I changed the entries. But when I
> >> > build
> >> > and deploy and look at the registry entries on the target system they
> >> > aren't
> >>
> >> Are those getting overwritten at build time or during FBA? (open pre-FBA
> >> image system hive and explore the settings under EventLog key)
> >>
> >> > what I set them to in the component. How do I control the EventLog
> >> > without
> >> > having the EventLog viewer on the target (including it bumps my usage
> >> > from
> >> > 60MB to 160MB and I can't afford that).
> >>
> >> Just add "Event Log" component and it will bring in the event logging
> >> functionality. Don't add the heavy "Administration Support Tools" which
> >> includes the Event Viewer (the exe).
> >>
> >> KM
> >>
> >
> >
>

Slobodan Brcin \(eMVP\)
07-09-2005, 10:25 PM
Larry,

Please read this post:
http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/6a1597586bcb4e13?hl=en&lr=&ie=UTF-8&c2coff=1

Regards,
Slobodan


"Larry Waibel" <lwaibel@no-spam-cox.net> wrote in message news:VA.00000293.0a510259@no-spam-cox.net...
> I'd hoped it would have been easier to find than that :-) Guess since I have
> an application that starts up each boot I'll just have it set the registry
> values. I just hate not knowing what's going on!
>
> In article <OHv$AUiYFHA.712@TK2MSFTNGP14.phx.gbl>, Km wrote:
> > From: "KM" <konstmor@nospam_yahoo.com>
> > Subject: Re: EventLog control
> > Date: Thu, 26 May 2005 11:59:15 -0700
> > Newsgroups: microsoft.public.windowsxp.embedded
> >
> > Larry,
> >
> > > Okay, I figured out how to load the hive from my XP build and look at it
> > > with
> > > regedit.
> >
> > Good.
> >
> > > The values in there are as I set them in TD which is what I want.
> >
> > Perfect. Now we know that it is some component that changes the values
> > during FBA.
> >
> > > So something is happening later to change them. There's an entry toward
> > > the
> > > end of the FBA log that says 'replacing system hives' but that's about all
> > > I see.
> >
> > This is required FBA step and it is not relevant to the issue.
> >
> > > How do I determine what's changing the values?
> >
> > That may be hard to find out. At least very labourous. You can put some
> > generic FBA commands to call CMD at diffenret FBA phases. The FBA should
> > wait until you close CMD window. In CMD you call to regedit and check out
> > the reg.value. This way you would know at what FBA phase the value gets
> > changed. Then you look at the [HKLM\System\CCS\Control\Windows Embedded\FBA]
> > key to see what FBA command is run at that phase.
> >
> > Another way could be in creating a reg.monitoring app that would be launched
> > early to watch on when values are changed at particular registry branch and
> > log the changes. This way you again know when the value was changed.
> >
> > It may be just easier to change the reg.values at the end of FBA (either
> > through very late FBA command or through StartUp item if you have Explorer
> > Shell).
> >
> > KM
> >
> > > In article <ecEY86aYFHA.3864@TK2MSFTNGP10.phx.gbl>, Km wrote:
> > >> From: "KM" <konstmor@nospam_yahoo.com>
> > >> Subject: Re: EventLog control
> > >> Date: Wed, 25 May 2005 21:52:36 -0700
> > >> Newsgroups: microsoft.public.windowsxp.embedded
> > >>
> > >> Larry,
> > >>
> > >> > I'm using the EventLog component in my configuration. I wanted to
> > >> > limit
> > >> > the
> > >> > logs to 64K and have them overwrite as needed. In the Target Designer
> > >> > in
> > >> > the
> > >> > EventLog component Registry Data, I changed the entries. But when I
> > >> > build
> > >> > and deploy and look at the registry entries on the target system they
> > >> > aren't
> > >>
> > >> Are those getting overwritten at build time or during FBA? (open pre-FBA
> > >> image system hive and explore the settings under EventLog key)
> > >>
> > >> > what I set them to in the component. How do I control the EventLog
> > >> > without
> > >> > having the EventLog viewer on the target (including it bumps my usage
> > >> > from
> > >> > 60MB to 160MB and I can't afford that).
> > >>
> > >> Just add "Event Log" component and it will bring in the event logging
> > >> functionality. Don't add the heavy "Administration Support Tools" which
> > >> includes the Event Viewer (the exe).
> > >>
> > >> KM
> > >>
> > >
> > >
> >
>
>


EventLog control