Backend WindowsEventLog

Windows Event Log Backend

WindowsEventLogBackend writes accepted log records to Windows Event Log.

It is intended for Windows services and deployments where operations teams inspect events through Event Viewer or central Windows event collection.

Type id

The backend type id is:

WindowsEventLogBackend

Configuration fields

WindowsEventLogBackendConfig::Parse() supports these backend-specific fields:

Field	Type	Default	Meaning
source	string	current executable base name	Windows Event Log source name
event-id	unsigned integer	1000	Event id written with each record
category	unsigned integer, 0..65535	0	Event category

Common backend fields from BackendConfig are also parsed, including async where supported.

Example:

{
  "type": "WindowsEventLogBackend",
  "source": "MyService",
  "event-id": 1000,
  "category": 0,
  "async": true
}

Level mapping

The backend maps logme levels to Windows event types:

• ERROR and CRITICAL become Windows error events
• WARN becomes a Windows warning event
• lower levels become informational events

Async behavior

The backend supports synchronous and asynchronous delivery.

In async mode, records are copied into a process-local Windows Event Log manager queue and drained by a manager thread. The manager is created when the first async event-log backend is used and is torn down after the last async event-log backend is removed.

During shutdown or fallback paths, the backend writes synchronously so records are not left stranded in the queue.

Non-Windows behavior

The backend is kept build-compatible on non-Windows platforms, but the actual Windows Event Log write path is a no-op there. Use this backend only when the target deployment has Windows Event Log.

Related code areas

• include/Logme/Backend/WindowsEventLogBackend.h
• source/Backend/WindowsEventLogBackend.cpp
• source/Backend/WindowsEventLogBackendConfig.cpp
• include/Logme/WindowsEventLog/WindowsEventLogManager.h
• source/WindowsEventLog/WindowsEventLogManager.cpp