Windows Logging:

Problems to address here:
- event logging is not only writting a string, there are event numbers,
  message resource DLLs and FormatString involved here. This has to be
  nicely integrated with the snprintf-way of logging on Unix/syslog.
- EventLog can be done locally or remotly
- strings like event sources can be localized again
- how are log levels mapped to event types
- how do we make use of event log's categories.
- and of course all has to be buildable with a simple (N)Makefile
- integration of strings like UNC host, event source, messages and their
  character sets without adding a string abstraction layer or funny
  switches in the code
- tracing data should not go to neither syslog or event log
- there should be some protection against flooding the logs as they
  are a system-wide scarse resource!
- get the current User SID and log it (so we see in the event log under
  which user the service/program was running)
- Register the event source to the registry, also specify where the
  category and messaging DLLs are with localized names and format strings.
  (they should be especially packaged or even be delivered in source, so
  the admin can compile and use them at wish)

Other projects:

- .NET EventLog class
- log4j
- POCOs: EventLogChannel.cpp
- www.codeproject.com/KB/cpp/logdriver.aspx
- log4cpp: NTEventLogAppender.cpp
- log4cplus: nteventlogappender.cxx

All of them ignore the message resource and classes of same errors with
different parameters. Sadly enough also the MS guys themselves (see
184416764.html). log4j has influenced log4cpp, log4pp, logdriver (IMHO
to the worse!).

The category is usually used for mapping the coarser grained levels of
the logging API to the event logger (POCO, log4cpp). IMHO this is better
used for something like subsystems or components.

log4cplus is the only library to handle the current user SID.

log4cplus adds the event source to the registry in the best way.

.NET at least cares to install a dummy message DLL with a %1's in them.
Also POCO and the rest take "the one event message" approach. 

Good articles:
- http://www.codeproject.com/KB/dotnet/evtvwr.aspx

C/C++ grammars:
- http://www.sigala.it/sandro/download.php

other links:
- http://www.codeproject.com/KB/debug/STLDebugLogger.aspx?display=Print
- http://www.codeproject.com/KB/IP/syslog_client.aspx
- http://www.softpanorama.org/Logs/Syslog/syslog_for_windows.shtml