Event Logging API function “ReportEvent” Returns “ERROR_INVALID_PARAMETER” 0x57 when Event Source contains predefined XML entities

  • Article

The Event Logging API allows user code to write Event Information into the Windows Event Log.

There is a nice example how to do it in MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/aa363680(v=vs.85).aspx

When you are using the function ReportEvent the function might return the error  ERROR_INVALID_PARAMETER (0x57) if you are trying to report an event to an Event Source if the Source Name contains characters predefined in XML such as: “, &, ‘ <, >

Example Event Source: My<EventProvider>

The Problem with that is, that the underneath Event Logging Engine logs into XML files internally. Thus, using predefined XML characters causes subsequent validations to fail.

You can work around this problem by making use of the appropriate esacpe sequences:

Capture

 

Example of an Event Source containing XML escape sequences: My&lt;EventProvider&gt;

You need to apply the same logic for while reistering your custom Event Provider as shown below:

image

This is how it looks like when it succeeds:

el

Please let me know how it worked for you!