EvtFormatMessage function fails with error code 15033 (ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND) on non-English Windows OS

Question

I have an App which subscribes to Windows events and if it is matching the filter criteria, it reports it.
I have observed a strange problem on non-English windows 2008 OS. 
If the Windows event is of source = EventLog (e.g. Event ID 1102: Security log was cleared), then EvtFormatMessage fails with error code 15033. But if the event is of any other source (e.g. Microsoft Security Auditing), then it works absolutely fine.
While calling EvtOpenPublisherMetadata, I have created locale ID as MAKELCID(MAKELANGID(0x09,0x01) i.e. Primary language = LANG_ENGLISH and Sub Language = SUBLANG_DEFAULT.
I want events details in English only and hence primary language is put as English. If I change this macro to have primary language as LANG_CHINESE and sub language as SUBLANG_CHINESE_SIMPLIFIED, then it works fine but gives back event details in native
OS language (Chinese in this case). That's not a desirable output for me.
Following is the way I'm calling EvtFormatMessage 
EvtFormatMessage(hMetaData, hEvent[0], -1, 0, NULL,
                               1 /* EvtFormatMessageEvent */, 
                               m_pTextBufferSize/sizeof(WCHAR),
                               m_pTextBuffer, &dwBuffUsed);
A work-around for this is to install a MUI pack for English language. If the MUI pack is installed then it works fine. But I cannot enforce users to have this pack installed on all their systems.
My question is  why this API is working for some set of Events whereas failing for some specific Events? Am I doing something wrong?
Any help would be appreciated.
TIA,
Regards,
Yogesh
 

Answer 1

Was on vacation and hence the delay in replying.
As mentioned earlier, while calling EvtOpenPublisherMetadata, I have created locale ID as MAKELCID(MAKELANGID(0x09,0x01)
i.e. Primary language = LANG_ENGLISH and Sub Language = SUBLANG_DEFAULT.  If I change this macro
to have primary language as LANG_CHINESE and sub language as SUBLANG_CHINESE_SIMPLIFIED, then it works fine but gives back event details in native OS language (Chinese in this case).
This is not an option for me as I want event details in English language only.
Regards,
Yogesh
Regards, Yogesh