Event Log Reference (POSReady 7)

Article
04/30/2013

4/29/2013

Keyboard Filter includes event logging to help with debugging and to meet auditing requirements. Administrators can also use event logging to monitor how Keyboard Filter is operating.

Event Logs

Event logs for Keyboard Filter are available in Event Viewer. The following table shows the event log locations.

Location	Description	Default state
Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows, KeyboardFilter\Admin	Logs errors	Enabled
Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\KeyboardFilter\Operational	Logs informational events and state changes	Disabled

Service Errors (Admin)

Win32 Errors

Win32 error messages contain an error code and message that may be localized by the Windows operating system.

Error	Description
ServiceTokenUnavailable	Unable to access the user session.
ServiceGrantPermission	Unable to impersonate the user. This message may indicate that the service is not configured correctly.
ServicePolicyEventError	Unable to obtain notification of policy changes.
ServiceDriverUpdateError	Unable to transmit data to the driver. This message may indicate that the driver is not running.
ServiceSessionStartHook	Unable to create the process in the user session or desktop.

Parsing Errors

When interpreting custom key filters, parsing errors may occur.

Error	Description
ServiceCustomIncorrectModifier	Called when a modifier in a custom filter is incorrect. This error can be a combination that is not valid, such as Alt+Alt+C, or C+A. The incorrect value is specified.
ServiceCustomIncorrectKey	Called when the final key in a custom filter is incorrect. This error can be an unreadable or incorrect value, such as Ctrl+Break. The incorrect value is specified.
ServiceCustomIncorrectFormat	Called when the string cannot be interpreted. Incorrect delimiters, zero or overflow (50) length values, or incorrect characters can cause this.

Error Notification

Error notification messages indicate an error but do not display an error code.

Error	Description
ServiceSessionHandleAbandoned	Called when a kernel event is abandoned. This error situation should never occur.

Service Status (Operational)

Service Notification

Service notification messages contain no parameters.

Error	Description
ServiceStarted	Service is operational.
ServiceStopped	Service has shut down cleanly.

Service Message

Service messages are used for debugging and contain a hard-coded string value.

Error	Description
ServiceMessage	Undefined

Service Filter State Changes (Operational)

User Notification

User notification messages contain the user name that initiated the log entry.

Error	Description
ServiceLogonAdmin	The administrator has logged on. This message occurs only when the user belongs to the Administrators group and filtering is disabled for the administrator.
UserLogoffDisableFilter	The user has logged off or locked the console, and filtering is disabled.
ServiceLogonUser	The user has logged on, and filtering is enabled.

System Notification

System notification messages are initiated by configuration changes.

Error	Description
ServiceLoadPolicies	A policy setting change is detected, and policy settings are being reloaded.

Share via