Share via


Event Log Reference (POSReady 7)

4/29/2013

Keyboard Filter includes event logging to help with debugging and to meet auditing requirements. Administrators can also use event logging to monitor how Keyboard Filter is operating.

Event Logs

Event logs for Keyboard Filter are available in Event Viewer. The following table shows the event log locations.

Location Description Default state

Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows, KeyboardFilter\Admin

Logs errors

Enabled

Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\KeyboardFilter\Operational

Logs informational events and state changes

Disabled

Service Errors (Admin)

Win32 Errors

Win32 error messages contain an error code and message that may be localized by the Windows operating system.

Error Description

ServiceTokenUnavailable

Unable to access the user session.

ServiceGrantPermission

Unable to impersonate the user. This message may indicate that the service is not configured correctly.

ServicePolicyEventError

Unable to obtain notification of policy changes.

ServiceDriverUpdateError

Unable to transmit data to the driver. This message may indicate that the driver is not running.

ServiceSessionStartHook

Unable to create the process in the user session or desktop.

Parsing Errors

When interpreting custom key filters, parsing errors may occur.

Error Description

ServiceCustomIncorrectModifier

Called when a modifier in a custom filter is incorrect. This error can be a combination that is not valid, such as Alt+Alt+C, or C+A. The incorrect value is specified.

ServiceCustomIncorrectKey

Called when the final key in a custom filter is incorrect. This error can be an unreadable or incorrect value, such as Ctrl+Break. The incorrect value is specified.

ServiceCustomIncorrectFormat

Called when the string cannot be interpreted. Incorrect delimiters, zero or overflow (50) length values, or incorrect characters can cause this.

Error Notification

Error notification messages indicate an error but do not display an error code.

Error Description

ServiceSessionHandleAbandoned

Called when a kernel event is abandoned. This error situation should never occur.

Service Status (Operational)

Service Notification

Service notification messages contain no parameters.

Error Description

ServiceStarted

Service is operational.

ServiceStopped

Service has shut down cleanly.

Service Message

Service messages are used for debugging and contain a hard-coded string value.

Error Description

ServiceMessage

Undefined

Service Filter State Changes (Operational)

User Notification

User notification messages contain the user name that initiated the log entry.

Error Description

ServiceLogonAdmin

The administrator has logged on. This message occurs only when the user belongs to the Administrators group and filtering is disabled for the administrator.

UserLogoffDisableFilter

The user has logged off or locked the console, and filtering is disabled.

ServiceLogonUser

The user has logged on, and filtering is enabled.

System Notification

System notification messages are initiated by configuration changes.

Error Description

ServiceLoadPolicies

A policy setting change is detected, and policy settings are being reloaded.

See Also

Concepts

Keyboard Filter Overview
Predefined Key Filter Configuration
Predefined Key Filter Reference
Custom Key Filter Configuration
Virtual Key Reference