Skip to main content

Writing events from COBOL in Microsoft Event Log on LOCAL or REMOTE computer using eventcreate command

  • February 16, 2013
  • 4 replies
  • 2 views
D
Created On:  2010-03-19

Problem:

I want to write an event which occurred in my application in the Microsoft Event Log on a LOCAL or on a REMOTE computer so I can easily control what happened using Microsoft Event Viewer. How do I proceed?

Resolution:

Please find the code is attached to this KB article.

The COBOL program just launches the eventcreate command.  See that the command, in the code:

Writes on the LOCAL Event Log
Writes on a REMOTE event log (you’ll have to change the Remote System name & accreditations)
Is called from  a MF Error Handler so the MF RTS error which occurred is written to Microsoft event log


Attachments

Old KB# 30865

    4 replies

    K
    • Kavitha Natarajan
    • Participating Frequently
    • 21 replies
    • June 17, 2025
    Created On:  2010-03-19

    Problem:

    I want to write an event which occurred in my application in the Microsoft Event Log on a LOCAL or on a REMOTE computer so I can easily control what happened using Microsoft Event Viewer. How do I proceed?

    Resolution:

    Please find the code is attached to this KB article.

    The COBOL program just launches the eventcreate command.  See that the command, in the code:

    Writes on the LOCAL Event Log
    Writes on a REMOTE event log (you’ll have to change the Remote System name & accreditations)
    Is called from  a MF Error Handler so the MF RTS error which occurred is written to Microsoft event log


    Attachments

    Old KB# 30865

    Hi, I have the same requirement in my current project. CobEventCreate.cbl code link in above post is not working. Can you please guide to the code content again? It will be of great help.Thanks in advance!



    ------------------------------
    Kavitha Natarajan
    Rocket Software Forum Member
    ------------------------------
    Yvon Abgrall
    • Yvon AbgrallRocketeer
    • Rocketeer
    • 37 replies
    • June 18, 2025

    Hi, I have the same requirement in my current project. CobEventCreate.cbl code link in above post is not working. Can you please guide to the code content again? It will be of great help.Thanks in advance!



    ------------------------------
    Kavitha Natarajan
    Rocket Software Forum Member
    ------------------------------

    Works on my side

    I compile this way: cobol ccobreportevent.cbl int();    run cobreportevent

    I initially attached a wrong .cbl...



    ------------------------------
    Yvon Abgrall
    Support engeneer
    Rocket Internal - All Brands
    ... FR
    ------------------------------
    Yvon Abgrall
    • Yvon AbgrallRocketeer
    • Rocketeer
    • 37 replies
    • June 18, 2025

    Works on my side

    I compile this way: cobol ccobreportevent.cbl int();    run cobreportevent

    I initially attached a wrong .cbl...



    ------------------------------
    Yvon Abgrall
    Support engeneer
    Rocket Internal - All Brands
    ... FR
    ------------------------------
          $set case
           program-id. 'WRTLOGFILE'.
     
           environment division.
               special-names. call-convention 74 is WINAPI.
     
           data division.
     
           78 78-ServiceName           value
              'COBOL WRT NTlogfile'.
     
     
           01 string-ptr                     pic x comp-x.
           01 msg-rec                        pic x(51).
           01 HANDLE                         pic x(4) comp-5 is typedef.
           01 hEventSource                   usage HANDLE.
           01 pString                        usage pointer.
     
           78 EVENTLOG-INFORMATION-TYPE      value 4.
     
          *linkage section.
     
           01 msg-1                pic x(50).
           01 msg-2                pic x(50).
           01 msg-3                pic x(50).
           01 msg-4                pic x(50).
     
           procedure division.
          *    call "cob32api".
     
               move "*--> COBOL msg-1"     to msg-1
               move "*--> COBOL msg-2"     to msg-2
               move "*--> COBOL msg-3"     to msg-3
               move "*--> COBOL msg-4"     to msg-4
               move spaces                 to msg-rec
     
               move 1 to string-ptr
               string msg-1 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-2 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-3 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-4 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               exit program.
               goback .
               stop run.
     
           do-report-event.
          *    Register as an event source
               call WINAPI 'RegisterEventSourceA'
                   using by value 0 size 4
                         by reference 78-ServiceName & x'00'
                   returning hEventSource
               if hEventSource not = 0
          *        Successfully registered. Report the event
                   set pString to address of msg-rec
                   call WINAPI 'ReportEventA'
                       using by value hEventSource
                             by value EVENTLOG-INFORMATION-TYPE size 2
                             by value 333 size 2
                             by value 0   size 4
                             by value 0   size 4
                             by value 1   size 2
                             by value 0   size 4
                             by reference pString
                             by value 0 size 4
                   call WINAPI 'DeregisterEventSource'
                       using by value hEventSource
               end-if
     
     
     


    ------------------------------
    Yvon Abgrall
    Support engeneer
    Rocket Internal - All Brands
    ... FR
    ------------------------------
    Yvon Abgrall
    • Yvon AbgrallRocketeer
    • Rocketeer
    • 37 replies
    • June 20, 2025
          $set case
           program-id. 'WRTLOGFILE'.
     
           environment division.
               special-names. call-convention 74 is WINAPI.
     
           data division.
     
           78 78-ServiceName           value
              'COBOL WRT NTlogfile'.
     
     
           01 string-ptr                     pic x comp-x.
           01 msg-rec                        pic x(51).
           01 HANDLE                         pic x(4) comp-5 is typedef.
           01 hEventSource                   usage HANDLE.
           01 pString                        usage pointer.
     
           78 EVENTLOG-INFORMATION-TYPE      value 4.
     
          *linkage section.
     
           01 msg-1                pic x(50).
           01 msg-2                pic x(50).
           01 msg-3                pic x(50).
           01 msg-4                pic x(50).
     
           procedure division.
          *    call "cob32api".
     
               move "*--> COBOL msg-1"     to msg-1
               move "*--> COBOL msg-2"     to msg-2
               move "*--> COBOL msg-3"     to msg-3
               move "*--> COBOL msg-4"     to msg-4
               move spaces                 to msg-rec
     
               move 1 to string-ptr
               string msg-1 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-2 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-3 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-4 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               exit program.
               goback .
               stop run.
     
           do-report-event.
          *    Register as an event source
               call WINAPI 'RegisterEventSourceA'
                   using by value 0 size 4
                         by reference 78-ServiceName & x'00'
                   returning hEventSource
               if hEventSource not = 0
          *        Successfully registered. Report the event
                   set pString to address of msg-rec
                   call WINAPI 'ReportEventA'
                       using by value hEventSource
                             by value EVENTLOG-INFORMATION-TYPE size 2
                             by value 333 size 2
                             by value 0   size 4
                             by value 0   size 4
                             by value 1   size 2
                             by value 0   size 4
                             by reference pString
                             by value 0 size 4
                   call WINAPI 'DeregisterEventSource'
                       using by value hEventSource
               end-if
     
     
     


    ------------------------------
    Yvon Abgrall
    Support engeneer
    Rocket Internal - All Brands
    ... FR
    ------------------------------

    See code

    :) Yvon

    === ===

          $set case sourceformat"variable"
           program-id. MSReportEvent as "MSReportEvent".
           environment division.
               special-names. call-convention 74 is WINAPI.
     
           data division.
           working-storage section.  
           78 78-ServiceName           value
              'COBOL MSReportEvent'.
           
           01 int      is typedef pic s9(9)  comp-5.
           01 ulong    is typedef pic 9(9)   comp-5.
           01 BOOL     is typedef int.
           01 DWORD    is typedef ulong.
           01 uns-long pic  9(9)  comp-5 is typedef.
     
           01 string-ptr                     pic x comp-x.
           01 msg-rec                        pic x(51).
           01 HANDLE                         pic x(4) comp-5 is typedef.
           01 hEventSource                   usage HANDLE.
           01 pString                        usage pointer.
     
           78 EVENTLOG-INFORMATION-TYPE      value 4.
           
          *--> zones below used by API getusername & getcomputername
           01 Buffer                        pic x(1024).
           01 BufferLen                     DWORD.
           01 aBool                          BOOL.
           78 isTrue                        value 1.
           
           01 SID pic x(256).
           01 SIDlen DWORD value 256.
           01 ReferencedDomainName pic x(64).
           01 ReferencedDomainNameLen DWORD value 64.
           01  1-SID-AND-ATTRIBUTES               is typedef.
            02 1sid              usage pointer.
            02 1attributes       usage uns-long.       
           01 enum_SID_NAME_USE    1-SID-AND-ATTRIBUTES.
          *linkage section.
     
           01 msg-1                pic x(50).
           01 msg-2                pic x(50).
           01 msg-3                pic x(50).
           01 msg-4                pic x(50).
     
           procedure division.
          *    call "cob32api".
          *
          *-->     Get the Computer Name
                   move 1024 to BufferLen move spaces to buffer
                   call WINAPI "GetComputerNameA" using
                        by reference Buffer,
                        by reference BufferLen
                        returning aBool
                   end-call
                   if aBool is not equal to isTrue
                       move "??????????" to  Buffer(1:10)
                   end-if
                   display "**-> PC name: " buffer(1:bufferlen)
                   
          *-->     Get the user Name
                   move 1024 to BufferLen move spaces to buffer
                   call WINAPI "GetUserNameA" using
                        by reference Buffer,
                        by reference BufferLen
                        returning aBool
                   end-call
                   if aBool is not equal to isTrue
                       move "??????????" to  Buffer(1:10)
                   end-if
                   display "**-> PC name: " buffer(1:bufferlen)
                   
                   
                   
          *https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupaccountnamea
          *LookupAccountNameA
               inspect buffer replacing all spaces by low-values
               perform varying BufferLen from 1 by 1
                 until Buffer(BufferLen:1) = low-value
               end-perform
               
               call WINAPI "LookupAccountNameA"
                   using by value       0 size 4 *> local system
     
                         by reference  buffer
                         by reference  SID 
                         by reference  SIDlen
                         by reference  ReferencedDomainName
                         by reference  ReferencedDomainNameLen
                         by reference  enum_SID_NAME_USE
                   returning aBool
               if aBool = 0
                   display "LookupAccountSidA failed"
               else
                   display "LookupAccountSidA did succeed"
               end-if
     
               move "*--> COBOL msg-1"     to msg-1
               move "*--> COBOL msg-2"     to msg-2
               move "*--> COBOL msg-3"     to msg-3
               move "*--> COBOL msg-4"     to msg-4
               move spaces                 to msg-rec
     
               move 1 to string-ptr
               string msg-1 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-2 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-3 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               move 1 to string-ptr
               string msg-4 x'00' delimited by size into msg-rec
                   with pointer string-ptr
               perform do-report-event.
     
               exit program.
               goback .
               stop run.
     
           do-report-event.
          *    Register as an event source
               call WINAPI 'RegisterEventSourceA'
                   using by value 0 size 4
                         by reference 78-ServiceName & x'00'
                   returning hEventSource
               if hEventSource not = 0
          *        Successfully registered. Report the event
                   set pString to address of msg-rec
                   call WINAPI 'ReportEventA'
                       using by value hEventSource
                             by value EVENTLOG-INFORMATION-TYPE size 2
                             by value 333 size 2
                             by value 0   size 4
                             *>by value 0   size 4
                             by reference SID 
                             by value 1   size 2
                             by value 0   size 4
                             by reference pString
                             by value 0 size 4
                   call WINAPI 'DeregisterEventSource'
                       using by value hEventSource
               end-if
     
           end program MSReportEvent.



    ------------------------------
    Yvon Abgrall
    Support engeneer
    Rocket Internal - All Brands
    ... FR
    ------------------------------


    Terms & ConditionsAccessibility statement