[go/sys] Windows Service Example - Issue with Event Log

[Rolice]

What version of Go are you using (go version)?

$ go version
go version go1.15.6 windows/amd64

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=on
set GOARCH=amd64
set GOBIN=
set GOCACHE=...
set GOENV=...
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=...
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=...
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=NUL
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused
-arguments -fmessage-length=0 -fdebug-prefix-map=...=/tmp/go-build -gno-re
cord-gcc-switches

What did you do?

I am implementing a PoC with a cross-platform executables, one of which should be running as a service, respectively on Windows - a Windows Service. I was following the concepts within the official example and I have also tried the exact same code within, but I find an issue how event log is being presented. Initially, I though it is some issue with registering the function that will be responding to Windows Service Controller polling, but in time I realised it is purely related to the event log implementation (or at least that is what I think, based on the leads).

After opening an event log in the same fashion, every log function call result in wrong log being written to the Event Log:

elog, err = eventlog.Open(name)
elog.Info(1, fmt.Sprintf("starting %s service", name)) // Results in a message "Incorrect function." (General tab)
elog.Error(1, fmt.Sprintf("%s service failed: %v", name, err)) // Results in a message "Incorrect function." (General tab)

While trying to understand what is incorrect, I have found a doc with generic Win32 errors, going deeply these are also defined in Go as Windows errors.

The observation led me to that the first parameter of the logging functions (Info, Error, Warning), apart from being EventId, it is somehow being converted to HRESULT or similar and logged inside of the Event Log as a Win32 error.

When I tested with elog.Info(0, 'some message'), I was not surprised to find that also the message in General tab has changed to:

The operation completed successfully.

Behind these numbers in Win32 errors stands:

Win32 error codes	Description
0x00000000 ERROR_SUCCESS	The operation completed successfully.
0x00000000 NERR_Success	The operation completed successfully.
0x00000001 ERROR_INVALID_FUNCTION	Incorrect function.

Meanwhile, in the sys/windows/svc/eventlog/log.go this could be found:

// Info writes an information event msg with event id eid to the end of event log l.
// When EventCreate.exe is used, eid must be between 1 and 1000.
func (l *Log) Info(eid uint32, msg string) error {
	return l.report(windows.EVENTLOG_INFORMATION_TYPE, eid, msg)
}

// Warning writes an warning event msg with event id eid to the end of event log l.
// When EventCreate.exe is used, eid must be between 1 and 1000.
func (l *Log) Warning(eid uint32, msg string) error {
	return l.report(windows.EVENTLOG_WARNING_TYPE, eid, msg)
}

// Error writes an error event msg with event id eid to the end of event log l.
// When EventCreate.exe is used, eid must be between 1 and 1000.
func (l *Log) Error(eid uint32, msg string) error {
	return l.report(windows.EVENTLOG_ERROR_TYPE, eid, msg)
}

Obviously, there is some overlapping usage between eid (EventID) and Windows Error codes, but I am not sure where. It seems the EventId is shadowy transferred also as message for the event.

What did you expect to see?

I expect to see the corresponding message in the General tab of the Event, in the Event Log. The message seems anyway available on the second tab with the Details.

What did you see instead?

I see a Win32 error message corresponding to the error code, parsed from the eid (EventId).

[AlexRouSg]

The Go functions are basically just calling the C function ReportEventA, so you can reference the microsoft docs.

https://docs.microsoft.com/en-us/windows/win32/eventlog/reporting-an-event

[cherrymui]

@Rolice it seems you have a question about the golang/x/sys/windows/svc/eventlog package?

We don't really use our issue tracker for questions. More people will see your question, and you will get better answers, if you ask on a forum rather than on the issue tracker. See https://golang.org/wiki/Questions..

Feel free to reopen the issue if I'm mistaken. Thanks.