Reputation: 4802
I am attempting to compile an instrumentation manifest in order to build a manifest-based Windows Event Log provider. I expect the compiled manifest.h
file to include a ProviderGuid
symbol, as the example here has this symbol.
My manifest.xml
file:
<?xml version="1.0" encoding="utf-8"?>
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events"
xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
xmlns:xs="http://www.w3.org/2001/XMLSchema">
<instrumentation>
<events>
<provider name="MySampleProvider"
guid="{e585d1ba-488c-4adc-b752-f360e410d365}"
symbol="MyProvider"
resourceFileName="%SystemRoot%\\System32\\MySampleProvider.dll"
messageFileName="%SystemRoot%\\System32\\MySampleProvider.dll">
<events>
<event symbol="EVENT_MY_EVENT" value="1"
version="0" level="win:Informational"
template="MyEventTemplate"
message="$(string.MyEvent.Message)"/>
</events>
<templates>
<template tid="MyEventTemplate">
<data name="Message" inType="win:UnicodeString" outType="xs:string"/>
</template>
</templates>
<keywords>
<keyword name="MyKeyword" mask="0x1"/>
</keywords>
<tasks>
<task name="MyTask" eventGUID="{642836ec-9270-4b16-aacb-b971bcf357ae}" value="1"/>
</tasks>
<opcodes>
<opcode name="MyOpcode" value="10"/>
</opcodes>
<levels>
<level name="MyLevel" value="16" symbol="Informational"/>
</levels>
<channels>
<channel name="MyChannel" chid="MySampleProvider/Operational" type="Operational" enabled="true"/>
</channels>
</provider>
</events>
</instrumentation>
<localization>
<resources culture="en-US">
<stringTable>
<string id="MyEvent.Message" value="This is a sample event message."/>
</stringTable>
</resources>
</localization>
</instrumentationManifest>
I compile this file with "C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mc.exe" -h . -r . manifest.xml
. When I run this command, there are no errors or warnings displayed in the console.
After compiling, I searched the resulting manifest.h
file, but this file does not contain ProviderGuid
anywhere.
Is this expected? Am I misinterpreting what the example here is for?
Upvotes: 0
Views: 28
Reputation: 4802
I found the fix. I needed to change symbol="MyProvider"
in the provider
object to symbol="ProviderGuid"
, and then recompile. Then ProviderGuid
appeared in the manifest.h
file.
I realized this when I noticed the docs said
The example references the events defined in Publishing Your Event Schema for a Manifest-based Provider.
The Publishing Your Event Schema for a Manifest-based Provider page used ProviderGuid
as the symbol name in the example manifest.xml
.
The working manifest.xml
:
<?xml version="1.0" encoding="utf-8"?>
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events"
xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
xmlns:xs="http://www.w3.org/2001/XMLSchema">
<instrumentation>
<events>
<provider name="MySampleProvider"
guid="{e585d1ba-488c-4adc-b752-f360e410d365}"
symbol="ProviderGuid"
resourceFileName="%SystemRoot%\\System32\\MySampleProvider.dll"
messageFileName="%SystemRoot%\\System32\\MySampleProvider.dll">
<events>
<event symbol="EVENT_MY_EVENT" value="1"
version="0" level="win:Informational"
template="MyEventTemplate"
message="$(string.MyEvent.Message)"/>
</events>
<templates>
<template tid="MyEventTemplate">
<data name="Message" inType="win:UnicodeString" outType="xs:string"/>
</template>
</templates>
<keywords>
<keyword name="MyKeyword" mask="0x1"/>
</keywords>
<tasks>
<task name="MyTask" eventGUID="{642836ec-9270-4b16-aacb-b971bcf357ae}" value="1"/>
</tasks>
<opcodes>
<opcode name="MyOpcode" value="10"/>
</opcodes>
<levels>
<level name="MyLevel" value="16" symbol="Informational"/>
</levels>
<channels>
<channel name="MyChannel" chid="MySampleProvider/Operational" type="Operational" enabled="true"/>
</channels>
</provider>
</events>
</instrumentation>
<localization>
<resources culture="en-US">
<stringTable>
<string id="MyEvent.Message" value="This is a sample event message."/>
</stringTable>
</resources>
</localization>
</instrumentationManifest>
Upvotes: 0