3.1.1.7 Localized Logs
A log file that is exported from a channel does not contain the message strings for event levels, opcodes, tasks, keywords, and event descriptions. Support engineers often need to read the events from a customer's exported event log, including these strings, in order to diagnose issues on the customer's system. This protocol provides for localizing an exported log file in order to provide localized versions of those strings in whatever locale the support engineer requires. The EvtRpcLocalizeExportLog (section 3.1.4.18) protocol method generates the locale-dependent file.
A localized log is composed of two files. One is the standalone exported log file, as specified in section 3.1.1.6. The other is a locale-dependent file that contains all the localized strings.
The locale-dependent file groups localized strings into sections that correspond to the fields of events. For each publisher represented in the file, there is a section for event levels, opcodes, tasks, keywords, and event descriptions. Within each section, localized strings are presented in ordered records that include additional information, such that tools for viewing localized log files (which are out of scope for this protocol) can match each string with its corresponding event in the standalone exported log file. Following the final publisher in the file, is an event section that contains the localized event description strings for each event in the standalone exported log file.
The locale-dependent file has the following structure:
[Publisher Section]
<Publisher Name 0>
[Level Section]
<0> <Level value 0> <MessageID of level 0> <Localized string for Level 0>
...
<n> <Level value n> <MessageID of level n> <Localized string for Level n>
[Tasks Section]
<0> <Task value 0> <MessageID of task 0> <Localized string for task 0>
…
<m> <Task value m> <MessageID of task m> <Localized string for task m>
[Opcodes Section]
<0> <Opcode value 0> <MessageID of opcode 0> <Localized string for opcode 0>
…
<k> <Opcode value k> <MessageID of opcode k> <Localized string for opcode k>
[Keywords Section]
<0> <Keyword value 0> <MessageID of keyword 0> <Localized string of keyword 0>
…
<t> <Keyword value t> <MessageID of keyword t> <Localized string of keyword t>
…
<Publisher Name n>
[Level Section]
<0> <Level value 0> <MessageID of level 0> <Localized string for Level 0>
...
<n> <Level value n> <MessageID of level n> <Localized string for Level n>
[Tasks Section]
<0> <Task value 0> <MessageID of task 0> <Localized string for task 0>
…
<m> <Task value m> <MessageID of task m> <Localized string for task m>
[Opcodes Section]
<0> <Opcode value 0> <MessageID of opcode 0> <Localized string for opcode 0>
…
<k> <Opcode value k> <MessageID of opcode k> <Localized string for opcode k>
[Keywords Section]
<0> <Keyword value 0> <MessageID of keyword 0> <Localized string of keyword 0>
…
<t> <Keyword value t> <MessageID of keyword t> <Localized string of keyword t>
[Event Section]
<Event Record Id 0> <Localized event description string for event 0>
…
<Event Record Id n> <Localized event description string for event n>