6 releases

0.2.2 Feb 18, 2023
0.2.1 Feb 17, 2023
0.1.1 Oct 31, 2021
0.1.0 Jun 25, 2020
0.0.0 Jun 25, 2020

#144 in Debugging

Download history 17/week @ 2023-12-16 45/week @ 2024-01-06 139/week @ 2024-01-13 166/week @ 2024-01-20 75/week @ 2024-01-27 255/week @ 2024-02-03 521/week @ 2024-02-10 653/week @ 2024-02-17 676/week @ 2024-02-24 647/week @ 2024-03-02 613/week @ 2024-03-09 606/week @ 2024-03-16 504/week @ 2024-03-23 442/week @ 2024-03-30

2,226 downloads per month
Used in 4 crates (3 directly)


250 lines


Latest version Documentation

A log-compatible wrapper around the Windows Event Log API.

Thanks to Jeroen C. van Gelderen for creating the winlog project from which this is forked.


  • Writes Rust log messages to the Windows event log using the RegisterEventSourceW and ReportEventW APIs.
  • Provides utility functions to register/unregister your event source in the Windows registry.
  • Embeds a small (120-byte) message resource library containing the necessary log message templates in your executable.
  • Does not panic.

The five Rust log levels are mapped to Windows event types as follows:

Rust Log Level Windows Event Type Windows Event Id
Error Error 1
Warn Warning 2
Info Informational 3
Debug Informational 4
Trace Informational 5


  • Rust 1.29+ on Windows with MSVC toolchain
  • [Windows, optional] mc.exe and rc.exe (only required when eventmsgs.mc is changed)
  • [Windows, optional] PowerShell (used for the end-to-end test)



eventlog = "0.1.0"

Register log source with Windows

Register the log source in the Windows registry:

eventlog::register("Example Log").unwrap();

This usually requires Administrator permission so this is usually done during installation time.

If your MSI installer (or similar) registers your event sources you should not call this.

Log events

eventlog::init("Example Log", log::Level::Trace).unwrap();

info!("Hello, Event Log");
trace!("This will be logged too");

Deregister log source

Deregister the log source:

eventlog::deregister("Example Log").unwrap();

This is usually done during program uninstallation. If your MSI installer (or similar) deregisters your event sources you should not call this.


Artifacts eventmsgs.lib and eventmsgs.rs are under source control so users don't need to have mc.exe and rc.exe installed for a standard build.

  1. If build.rs determines that eventmsgs.mc was changed then build.rs:
    • invokes mc.exe (which creates eventmsgs.h)
    • invokes rc.exe (which creates eventmsgs.lib)
    • creates eventmsgs.rs from eventmsgs.h.
  2. build.rs emits linker flags so eventmsgs.lib can found.
  3. Standard cargo build follows.


The end-to-end test requires 'Full Control' permissions on the HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application registry key.

cargo test


  1. Create a unique temporary event source name (eventlog-test-###########).
  2. Register our compiled test executable as EventMessageFile for the event source in the Windows registry. You can see a new key at HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\eventlog-test-###########.
  3. Write some log messages to the event source.
  4. Use PowerShell to retrieve the logged messages.
  5. Deregister our event source. This removes the eventlog-test-########### registry key.
  6. Assert that the retrieved log messages are correct.


Licensed under either of

at your option.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.


~34K SLoC