Event Log Reference (POSReady 7)
4/29/2013
Keyboard Filter includes event logging to help with debugging and to meet auditing requirements. Administrators can also use event logging to monitor how Keyboard Filter is operating.
Event Logs
Event logs for Keyboard Filter are available in Event Viewer. The following table shows the event log locations.
| Location | Description | Default state |
|---|---|---|
Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows, KeyboardFilter\Admin |
Logs errors |
Enabled |
Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\KeyboardFilter\Operational |
Logs informational events and state changes |
Disabled |
Service Errors (Admin)
Win32 Errors
Win32 error messages contain an error code and message that may be localized by the Windows operating system.
| Error | Description |
|---|---|
ServiceTokenUnavailable |
Unable to access the user session. |
ServiceGrantPermission |
Unable to impersonate the user. This message may indicate that the service is not configured correctly. |
ServicePolicyEventError |
Unable to obtain notification of policy changes. |
ServiceDriverUpdateError |
Unable to transmit data to the driver. This message may indicate that the driver is not running. |
ServiceSessionStartHook |
Unable to create the process in the user session or desktop. |
Parsing Errors
When interpreting custom key filters, parsing errors may occur.
| Error | Description |
|---|---|
ServiceCustomIncorrectModifier |
Called when a modifier in a custom filter is incorrect. This error can be a combination that is not valid, such as Alt+Alt+C, or C+A. The incorrect value is specified. |
ServiceCustomIncorrectKey |
Called when the final key in a custom filter is incorrect. This error can be an unreadable or incorrect value, such as Ctrl+Break. The incorrect value is specified. |
ServiceCustomIncorrectFormat |
Called when the string cannot be interpreted. Incorrect delimiters, zero or overflow (50) length values, or incorrect characters can cause this. |
Error Notification
Error notification messages indicate an error but do not display an error code.
| Error | Description |
|---|---|
ServiceSessionHandleAbandoned |
Called when a kernel event is abandoned. This error situation should never occur. |
Service Status (Operational)
Service Notification
Service notification messages contain no parameters.
| Error | Description |
|---|---|
ServiceStarted |
Service is operational. |
ServiceStopped |
Service has shut down cleanly. |
Service Message
Service messages are used for debugging and contain a hard-coded string value.
| Error | Description |
|---|---|
ServiceMessage |
Undefined |
Service Filter State Changes (Operational)
User Notification
User notification messages contain the user name that initiated the log entry.
| Error | Description |
|---|---|
ServiceLogonAdmin |
The administrator has logged on. This message occurs only when the user belongs to the Administrators group and filtering is disabled for the administrator. |
UserLogoffDisableFilter |
The user has logged off or locked the console, and filtering is disabled. |
ServiceLogonUser |
The user has logged on, and filtering is enabled. |
System Notification
System notification messages are initiated by configuration changes.
| Error | Description |
|---|---|
ServiceLoadPolicies |
A policy setting change is detected, and policy settings are being reloaded. |
See Also
Concepts
Keyboard Filter Overview
Predefined Key Filter Configuration
Predefined Key Filter Reference
Custom Key Filter Configuration
Virtual Key Reference