Sending ETW Events to Global "Application" Log

Question

I'd like to enable my app to make warnings and errors visible to the global "Application" log in Windows Event Viewer. I've successfully followed the directions here that helped me get ETW up and running, but I only see events when I explicitly enable logging via a tracing program, and even then they only show up in the generated .etl file, not in the global log.

How can I programmatically register and write events to the global Application log, so that when users run event viewer, they'll see events from my app? Is it even possible? In a nutshell, I want to end up with something like the screenshot below, just with less photoshopping required:

Answer 1

ETW seems to be quite complex for your purpose, here's the procedure to write to the Event Log:

a) One-time (you would typically do this while installing your application) Register your application as a Event Provider; only the EventMessageFile entry is really required:
- key = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\MyCoolGame
- string name (REG_EXPAND_SZ) = EventMessageFile
- string value = C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

b) On program startup: Register Event Source and receive a handle:

hEventLog = RegisterEventSource(NULL, lpszAppNameName);

c) Use the ReportEvent function to write entries to the Event Log:

TCHAR szLogBuffer[] = _T("Started new multiplayer server.");
const TCHAR *lpszEventStrings[2] = {szLogBuffer, NULL};
ReportEvent(hEventLog, EVENTLOG_INFORMATION_TYPE, 0, 1, NULL, 1, 0, lpszEventStrings, NULL)

d) On program shutdown:

DeregisterEventSource(hEventLog);