Dumpevt eventdescription different

Hi,

In the output of Dumpevt the discription is different for a event then when looking in the eventlog.

Dumpevt:
SYS 6-6-2006 11:49:56 TermService 1041 Error None <servername> The system has failed to hibernate (The error code is hs). Hibernation will be disabled until the system is restarted.

Eventlog:
Type: Error
Source: TermService
Event ID: 1041
Event Time: 6-6-2006 11:49:56
User: n/a
Computer: <servername>
Description: Autoreconnect failed to reconnect user to session because authentication failed. (0x0)

I did test this remote from a w2k server and local on that w2k3 machine.

This is de local cmdline output:
C:\Temp\Dumpevt>dumpevt /logfile=sys /outfile=<servername>sys.txt /all /computer=<servername>
7-6-2006 9:58:23
Somarsoft DumpEvt V1.7.5, Copyright ® 1995-1997 by Somarsoft, Inc.
LogType=System
Computer=<servername>
SystemRoot=C:\WINDOWS
Outfile=<servername>sys.txt
Use HKEY_CURRENT_USER for saving record number
Format=yes
DateFormat=(locale dependent)
TimeFormat=HH':'mm':'ss
FieldSeparator= (tab)
ReplaceFieldSeparator=_
ReplaceCR=^
ReplaceLF=`
StringSeparator=~
MaxMessageLen=1700
MaxFragmentLen=255
DumpData=none
SplitDateTime=no
UseGmtTime=no
DumpRecnum=no
process all event log records
==>unable to resolve environment variable, sz=%SystemDrive%\\hp\\hpsmh\\bin\\smh
start.exe
==>Format message error, source=HP System Management Homepage type=Category msg=
1 rc=0
==>unable to resolve environment variable, sz=%SystemDrive%\hp\hpsmh\bin\smhstar
t.exe
==>Format message error, source=HP System Management Homepage type=Message msg=9
rc=0
==>Format message error, source=HP System Management Homepage type=Message msg=1
0 rc=0
==>LoadLibrary rc=2 library=\\<servername>\w$nhttp.dll
==>Format message error, source=WinHttpAutoProxySvc type=Message msg=12503 rc=31
7
==>Format message error, source=WinHttpAutoProxySvc type=Message msg=12517 rc=31
7
==>Format message error, source=Automatic Updates type=Category msg=1 rc=1813
==>Format message error, source=Automatic Updates type=Message msg=16 rc=1813
==>RegOpenKeyEx rc=2 source=rdpdr key=SYSTEM\CurrentControlSet\Services\EventLog
\System\rdpdr
==>Format message error, source=rdpdr type=Message msg=54 rc=317
last event log record processed = 7486
Elapsed time= 1.203 seconds, NumRecs=7486

How can we fix this?

Thanx.

[This message has been edited by VGZ-SBS (edited 06-07-2006).]

[kstanush]

Re: Dumpevt eventdescription different

Due to how the event log works, this is almost impossible to debug. DumpEvt is essentially provided on an 'as-is' basis.