Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the maximum message length in the EventLog.WriteEntry method documentation #9999

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

0xced
Copy link

@0xced 0xced commented Jun 6, 2024

Summary

It was found empirically on Windows 10 that the maximum message length is 31,718.

It was found empirically on Windows 10 that the maximum message length is 31,718.
@0xced 0xced requested a review from a team as a code owner June 6, 2024 13:26
@dotnet-policy-service dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label Jun 6, 2024
Copy link
Contributor

Tagging subscribers to this area: @tommcdon

Copy link

Learn Build status updates of commit a78d259:

✅ Validation status: passed

File Status Preview URL Details
xml/System.Diagnostics/EventLog.xml ✅Succeeded View

For more details, please refer to the build report.

For any questions, please:

@gewarren
Copy link
Contributor

@tommcdon Could you review?

@tommcdon
Copy link
Member

.NET is using ReportEvent, and according to the Windows documentation for ReportEvent, our existing documentation is correct:

https://learn.microsoft.com/windows/win32/api/winbase/nf-winbase-reporteventw

[in] lpStrings
A pointer to a buffer containing an array of null-terminated strings that are merged into the message before Event Viewer displays the string to the user. This parameter must be a valid pointer (or NULL), even if wNumStrings is zero. Each string is limited to 31,839 characters.
Prior to Windows Vista:  Each string is limited to 32K characters.

The .NET code that calls ReportEvent is checking 32K-2 characters:

https://github.com/dotnet/runtime/blob/c1a9f26efa4fcf2e3fdcd8557da19d358f51eb00/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/EventLogInternal.cs#L1354-L1357

                // make sure the strings aren't too long.  MSDN says each string has a limit of 32k (32768) characters, but
                // experimentation shows that it doesn't like anything larger than 32766
                if (strings[i].Length > 32766)
                    throw new ArgumentException(SR.LogEntryTooLong);

Therefore, the error would likely be coming from Windows and not .NET for string lengths <= 32766 characters. Given that .NET has no control over the version of Windows and the various character limits it is imposing, I suggest we remove mentions of specific character limits under 32766 characters.

Also I would expect that if the string length is <= 32766 and the API call fails due to a restriction from Windows, we would get a Win32Exception and not an ArgumentException. @0xced can you confirm?

If yes, then I suggest changing the text to something like:
The message string is longer than 32,766 bytes.

Copy link
Member

@tommcdon tommcdon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left a comment for your review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-System.Diagnostics community-contribution Indicates that the PR has been added by a community member
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants