Anybody knows how to specify the manually-added event log's file name?

[Xiao]

Hi everybody,

I'd wanted to add a new event log to the system other than Application
log, Security log and System log. I modified the registry and added a new
key:
System\\CurrentControlSet\\Services\\EventLog\\MyType,

and I added some new keys under this new key:
key: System\\CurrentControlSet\\Services\\EventLog\\MyType\\File
value: %systemdrive%:\MyType.Evt
key: System\\CurrentControlSet\\Services\\EventLog\\MyType\\MaxSize
value: 0x00080000(524288)
key: System\\CurrentControlSet\\Services\\EventLog\\MyType\\Retention
value: 0x00093a80(604800)
AppSpyX\\Sources
value: AppSpyX // generated automatically

I intended that the system will use %systemdrive%:\mytype.evt as the log
file for the new event log information. But when I opened the Event
Viewer(I'm using Win2K RC3), I found the content displayed in the right view
when I clicked MyType kept identical with that of the Application log. No
matter how I modified either, the other also changed up. It's obvious the
system was using the Application log's AppEvent.evt as the MyType's log
file. I suspected it was the Event Viewer's bug, then I wrote a small
service program that registered as MyType and reported some events. But when
I looked into the file's binary data, I found all data had been written into
the AppEvent.evt, and the MyType.evt has no data except for the header.

Can you tell me where the bug is or if it works ok on your system, tell me
which version of Win2k are you using?

Any suggestions will be greatly appreciated!!

Best Wishes!

[Xiao]

Please never mind. I've got it.

[Rick Leinecker]

What is the answer? Others might need to know.

[Xiao]

Sorry. It's just a mistake :-)
I typed a redundant colon after the %systemdrive% when specifying the physical file name. The system couldn't locate the file, and used the Application log as a substitution.