Appender Reference

WindowsEventAppender

WindowsEventAppender Overview

WindowsEventAppender is a logging facility appender that supports event logging on Windows operating systems.

WindowsEventAppender Syntax

</appender>

WindowsEventAppender Syntax Description

name="AppName" value= "application name"

identifies the role of the SAS process. This parameter is ignored on Windows 5. On Windows 6, this parameter configures the WindowsEventAppender as a distinct Event Tracing for Windows (ETW) publisher for each role that the SAS process might perform. Here are some valid values for application name:

SAS Foundation
Metadata Server
OLAP Server

For information about the generic elements of the appender syntax, see General Appender Syntax.

WindowsEventAppender Example

The following example is a typical XML configuration file that specifies the WindowsEventAppender. The parameter identifies the role of SAS as the SAS Foundation.

<?xml version="1.0" encoding="UTF-8"?>
<logging:configuration
xmlns:logging="http://www.sas.com/xml/logging/1.0/">

   <appender name="eventLog" class="WindowsEventAppender">
      <param name="AppName" value="SAS Foundation"/>
      <layout>
         <param name="ConversionPattern"
                value="%d %-5p [%t] %c (%F:%L) - %m"/>
      </layout>
   </appender>

   <root>
      <level value="trace"/>
      <appender-ref ref="eventLog"/>
   </root>
<
/logging:configuration>

Note: The install and configuration process usually create a configuration file automatically. [cautionend]

WindowsEventAppender Usage

On Windows 5 (Windows XP and Windows Server 2003) WindowsEventAppender sends events to the Windows Event Log. The Event Log on these earlier versions of Windows might be easily overloaded. You should configure WindowsEventAppender so that the event log does not receive more events than it can handle.

On Windows 6 (Windows Vista and Windows Server 2008), WindowsEventAppender uses Event Tracing for Windows (ETW). The Event Viewer is a consumer of ETW on these versions of Windows. ETW exists in earlier Windows versions, but WindowsEventAppender uses ETW beginning with Version 6. Scalability is significantly improved in ETW.

Note that even on Windows 6, where each SAS role is associated with a distinct publisher that has its own logging channel, error events are sent to the channel for the Windows Application log. These error events are considered to be actionable events of the Windows admin channel.

Top of Page