Windows Event log missing log source

[edwardk]

The Windows Event log service does not have a message file registered when the smartd service is installed. This results in Event log messages similar to:

The description for Event ID ( 2 ) in Source ( smartd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: smartd, 3648, Info, Device:
.\scsi1: [areca_disk#08_enc#01], SMART Usage Attribute: 190 Airflow_Temperature_Cel changed from 69 to 68, Device:
.\scsi1: [areca_disk#08_enc#01], SMART Usage Attribute: 194 Temperature_Celsius changed from 31 to 32.

Registry entry keys can be added to fix this issue at

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\smartd

For my system:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\smartd]
"EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\
  00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,20,00,28,00,78,00,38,00,36,00,\
  29,00,5c,00,47,00,53,00,6d,00,61,00,72,00,74,00,43,00,6f,00,6e,00,74,00,72,\
  00,6f,00,6c,00,5c,00,62,00,69,00,6e,00,5c,00,73,00,79,00,73,00,6c,00,6f,00,\
  67,00,65,00,76,00,74,00,2e,00,65,00,78,00,65,00,00,00
"TypesSupported"=dword:00000007

[edwardk]

Registry Editor screenshot

[edwardk]

To clarify, EventMessageFile should point to where ever the user's copy of syslogevt.exe.

[Christian Franke]

Run "syslogevt -r smartd" to create the registry entry.

[Christian Franke]

r3756, r3758.