The description for Event ID ( XXX ) in Source ( Symantec ) cannot be found

Article:TECH99678  |  Created: 2002-01-07  |  Updated: 2006-01-26  |  Article URL
Article Type
Technical Solution




When viewing an Application Event log on a remote computer, you see "The description for Event ID ( XXX ) in Source ( Symantec ) cannot be found." It may be followed by "The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer." The following information "!!MESSAGES MISSING!!" or "It contains the following insertion string(s):.....service has started successfully" is also part of the event.


This error occurs when attempting to open Application Log files from a system which does not have Message File installed. The Event ID descriptions are not stored in the log, but in a Message File specific to each application installed. These message files are either .exe or .dll files. When the Application Log reads "the description cannot be found", it indicates that the Message File specific to the application (source) is not available on the system from which it is being viewed.

To display the event description properly, the Message File (.dll or .exe) must be installed on the viewing computer. Use the following steps to ensure that you have the correct file or files installed.

WARNING: In the next steps you will edit the Windows registry. We strongly recommend that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified. See How to back up the Windows registry for instructions.

To display the even description
  1. Exit all programs.
  2. On the Windows taskbar, click Start > Run.
  3. In the Run dialog box, type the following:

  4. Click OK.
  5. Go to the following registry key:

  6. Each application which writes to the Application Event Log will have a subkey. Select the application, and then check the EventMessageFile to determine the name and location. For example, for a client install of Norton AntiVirus Corporate Edition, the EventMessageFile will point to:

    C:\Program Files\NavNT\rtvscan.exe
  7. Export the registry key.
  8. Copy the referenced file and the registry key to the remote computer.
  9. Import the registry key to the remote computer registry and copy the file to the location specified in the registry key.
  10. The Event Viewer will now display Event ID messages correctly.

If you see this entry on a system when viewing its local application event viewer, it can be an indication of an incomplete or corrupted installation. Uninstalling and reinstalling the application usually resolves the problem.

Legacy ID


Article URL

Terms of use for this information are found in Legal Notices