如何用Python（PyWin32）注册Windows自定义事件日志？

Got it, let's solve this without relying on PowerShell—PyWin32 gives you full access to the Windows Registry (where event log configurations live) to set up your custom log entirely in Python. Here's how to do it step by step:

Key Background #

Windows stores event log settings in the HKLM\SYSTEM\CurrentControlSet\Services\EventLog registry hive. To add a custom log under "Applications and Services Logs", we need to create a new registry key for your log name, then configure a source and required values for it.

Critical Prerequisite #

You must run your Python script as Administrator—modifying the HKLM registry hive requires elevated privileges, otherwise the registry operations will fail.

Full Implementation Code #

import win32api
import win32con
import win32evtlog

def register_custom_event_log(log_name, source_name):
    # Registry path for the custom event log
    reg_path = f"SYSTEM\\CurrentControlSet\\Services\\EventLog\\{log_name}"
    
    try:
        # Create the top-level registry key for the custom log
        main_key = win32api.RegCreateKeyEx(
            win32con.HKEY_LOCAL_MACHINE,
            reg_path,
            0,
            win32con.KEY_WRITE,
            win32con.KEY_ALL_ACCESS,
            None
        )
        
        # Set required registry values for the log
        # Use the system's default event message DLL (works for basic text logs)
        system_dir = win32api.GetSystemDirectory()
        event_message_file = f"{system_dir}\\advapi32.dll"
        win32api.RegSetValueEx(main_key, "EventMessageFile", 0, win32con.REG_EXPAND_SZ, event_message_file)
        
        # Enable support for Info, Warning, and Error event types (0x07 = 1+2+4)
        win32api.RegSetValueEx(main_key, "TypesSupported", 0, win32con.REG_DWORD, 0x07)
        
        # Create a subkey for the event source (required to report events)
        source_subkey = win32api.RegCreateKeyEx(
            main_key,
            source_name,
            0,
            win32con.KEY_WRITE,
            win32con.KEY_ALL_ACCESS,
            None
        )
        
        # Clean up registry handles
        win32api.RegCloseKey(source_subkey)
        win32api.RegCloseKey(main_key)
        
        print(f"Successfully registered custom log '{log_name}' with source '{source_name}'")
        return True
    except Exception as e:
        print(f"Failed to register custom log: {str(e)}")
        return False

def write_to_custom_log(log_name, source_name, message):
    try:
        # Open the event log handle
        log_handle = win32evtlog.OpenEventLog(None, log_name)
        # Report an information event
        win32evtlog.ReportEvent(
            log_handle,
            win32evtlog.EVENTLOG_INFORMATION_TYPE,
            0,  # Event category (0 for default)
            1000,  # Custom event ID (you can change this)
            None,  # User SID (uses current user if None)
            [message],  # The message to log
            None  # Raw event data (None for no data)
        )
        win32evtlog.CloseEventLog(log_handle)
        print(f"Successfully wrote message to '{log_name}'")
    except Exception as e:
        print(f"Failed to write to event log: {str(e)}")

# Example usage
if __name__ == "__main__":
    CUSTOM_LOG_NAME = "MyPythonAppLogs"
    EVENT_SOURCE_NAME = "MyPythonService"
    
    # Register the log (only need to run this once)
    if register_custom_event_log(CUSTOM_LOG_NAME, EVENT_SOURCE_NAME):
        # Write a test message
        write_to_custom_log(CUSTOM_LOG_NAME, EVENT_SOURCE_NAME, "First message from my custom Python event log!")

Breakdown of Key Steps #

1. Registry Key Creation: We create a top-level key under HKLM\SYSTEM\CurrentControlSet\Services\EventLog with your custom log name—this is what tells Windows to display the log in the "Applications and Services Logs" section.
2. EventMessageFile: This points to a DLL that handles event message formatting. We use advapi32.dll (a built-in system DLL) which works perfectly for basic text-based logs—no need to build a custom DLL unless you need structured, localized event messages.
3. TypesSupported: This DWORD value defines which event types the log accepts. 0x07 enables Information, Warning, and Error events (you can adjust this if you only need specific types).
4. Source Registration: Every event needs to be tied to a source, so we create a subkey under our log key for the source name.
5. Writing Events: Once registered, the write process is identical to what you did after using PowerShell—win32evtlog.ReportEvent works the same way.

Verifying the Result #

After running the script as admin, open Event Viewer:

• Navigate to Applications and Services Logs > Your custom log name (e.g., MyPythonAppLogs)
• You should see your test message listed there.

内容的提问来源于stack exchange，提问作者Ichroman Raditya Duwila