this is what I get from today's CVS:

The description for Event ID ( 2000 ) in Source ( c-client ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: c-client[1368]; PHP Warning:  Failed opening 'index.html' for inclusion (include_path='./') in [path] on line 4.

Using "PHP 4.3.1 (cgi-fcgi), Copyright (c) 1997-2002 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2002 Zend Technologies"

I get the same message in windows XP when I use the syslog function.

The following message appears when I use the following command. 

syslog(LOG_ERR, "Could not select database");


Event Type:	Warning
Event Source:	c-client
Event Category:	(4)
Event ID:	2000
Date:		7/23/2003
Time:		2:57:26 PM
User:		N/A
Computer:	Nothing
Description:
The description for Event ID ( 2000 ) in Source ( c-client ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: c-client[3684], Could not select database.

This happens when there is no message catalog associated
with the event source in the registry.
The solution is to add an appropriate message catalog to
the win32 project, and enter the details into the registry
when PHP is installed.

However, this won't solve the case where the syslog is
opened with alternative message sources (such as c-client),
since each message source would need to be registered also.

OK I think i figured out something.

WinNT / XP has this commandline tool, eventcreate.exe.

I type from the command (DOS) prompt:

eventcreate /t error /id 100 /l application /d "Testing..."

And I get the similar error. No description for source, etc. etc.

But if I type:

eventcreate /t error /id 100 /l application /so myself /d "Testing..."

this is what I get the right description, and the origin is listed as "msyelf". So probably in the WinNT/XP API there is a way to indicate the origin with a string without the need to register it... in our case, the origin should be "PHP". Perhaps the origin could change between "PHP CLI", "PHP CGI" o "PHP SAPI".

I'm currently trying to figure out if there is a COM object for the event log or something to implement a workaround.

No, its not possible.
All eventcreate does is register itself as the source.
Try this:

eventcreate /t error /id 100 /l application /so foobar /d "This is a message"

and look here in the registry afterwards:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\foobar

I see. In any case, I think it'll be easy to register PHP as the source for PHP-error logs, right?

Thanks! (This is my last comment)

The problems with allowing PHP to register arbitrary event sources are:

1. PHP might not have permissions to write to that part
   of the registry, so it might not even be able to do it.
2. If it does, it could overwrite system defined message
   sources -> big problem for shared hosters.

IMO, it is better to register a single PHP event source at
installation time, and adapt the syslog code to log messages
using PHP as the source and output the user-defined source
in the log message itself.

Assuming Wez wants to do something about this..

Won't fix for PHP 4, but will fix for PHP 5.

changing version, probably will be fixed in 5.1

Fixed in HEAD; only took 3.5 years ;-)