Viewing eventlog files in the absence of resource strings.

Many a time, I had to look at eventlog files sent by a customer, or those from a test run that happened some time back. These files (.evt) are offline copies of eventlogs. To view them, you open them up with eventviewer.

However, you might sometimes notice that the display of these logs does not give the descriptive information that was logged. It will only show the parameters used when logging the message. For eg, if you create an eventlog entry with the followin format string:

"This operation failed with error %s"

then, the display will only show the parameter that was passed to the format string.

To work around this, you can use the /AUXSOURCE= flag to point eventviewer at another machine that might have the required resources to load the resource strings. This is done by invoking the eventviewer in the following manner:

mmc.exe /a eventvwr.msc /AUXSOURCE=<machine name or ip>