Event ID - how to derive from Instance ID

Posted on 2007-10-15
Medium Priority
Last Modified: 2008-01-09
I have a question regarding the Event ID in the Event Log.  I wrote a program that will read through events and update a database with event log information.  It appears that .NET only allows you to grab the InstanceID and that you must convert it to the Event ID that you see in the log.

Is there a 100%, guaranteed-to-work, method of getting the Event ID?

The following link has a discussion on this.  The second post in the link gives a VB routine that does the conversion.  I tried this and it works most of the time but I have a few events which are not converting properly.  The posts below indicate that this could be a problem but there doesn't seem to be complete agreement.


Does anyone have a better way of getting the EventID?  One that should always work?

Question by:chlade
1 Comment
LVL 41

Accepted Solution

graye earned 2000 total points
ID: 20087618
There are multiple issues here...

one is the MSDN documentation correctly indicates that to convert an "Instance ID" to an "Event ID", you just have to mask off the 2 two bits.  This is easly done with a simple "Logical And" operation, like:

   Dim EventID as Integer = Cint(entry.InstanceId and &H3FFFFFFF)

The second issue is that the Event Viewer doesn't follow the MSDN documentation, and therefore gives a different answer!.   So, if you want the InstanceID to match the EventID as seen in the Event Viewer, you'd need to mask a bit more

   Dim EventID as Integer = Cint(entry.InstanceId and &HFFFF)

So, the question comes down to:  Do yo want the "correct answer" or the "compatible answer"


Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: jpaulino
XML Literals are a great way to handle XML files and the community doesn’t use it as much as it should.  An XML Literal is like a String (http://msdn.microsoft.com/en-us/library/system.string.aspx) Literal, only instead of starting and ending with w…
Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…
Suggested Courses
Course of the Month13 days, 19 hours left to enroll

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question