NoteHKLM\SYSTEM\CurrentControlSet\Services\EventLog\<Log-name>\<Source-name>
| Data type | Range | Default value |
|---|---|---|
| REG_EXPAND_SZ | Path and file name [; Path and file name] | There is no default value for this entry. |
Stores the location of the file that contains event identifiers for the events generated by the source program and text describing each event. Typically, event identifiers are included in the dynamic link library (DLL) or executable file for the source program.
A program can enter more than one file name in this value. Because Event Viewer opens the files in the order in which they are listed, you should list files in the order in which event identifiers are most likely to be found.
Also, when displaying the event log of a remote computer, Event Viewer first tries to locate the event identifiers in the first event message file listed for the source on the remote computer. If Event Viewer cannot open the event message file or cannot find the event identifier, it searches in the first event message file listed for the source on the local computer before searching other event message files on the remote and local computer.
Note
The same file can be used as the value of EventMessageFile, CategoryMessageFile, and ParameterMessageFile.
Related Entries
