3.2.4.1.1 Loading Event Log Description Information

The localizable event log description is retrieved from DisplayNameFile and DisplayNameID by a client. The client MUST attempt to expand an environment variable, as described in section 3.2.4.1.5.4 to retrieve the full path to the resource file if the DisplayNameFile contains the environment variable. If the client is accessing a remote source, it MUST then convert the expanded resource file path to a UNC path: When the path begins with an "X:" pattern, where the first character is a drive letter and the second character is ":", the client MUST transform it to \\messageSourceServer\X$\path.

The format of the resource file is specified in [PE-COFF].

If both "DisplayNameFile"and "DisplayNameID" values are present, the client SHOULD attempt to load the resource file<44> by using the SMB Protocol, as specified in [MS-SMB], and to retrieve the resource string with the ID number specified by the "DisplayNameID" value data.<45>

If either of these two values is missing, the client will use the event log name directly as the description string.