Event ID - how to derive from Instance ID

Posted on 2007-10-15
Last Modified: 2008-01-09
I have a question regarding the Event ID in the Event Log.  I wrote a program that will read through events and update a database with event log information.  It appears that .NET only allows you to grab the InstanceID and that you must convert it to the Event ID that you see in the log.

Is there a 100%, guaranteed-to-work, method of getting the Event ID?

The following link has a discussion on this.  The second post in the link gives a VB routine that does the conversion.  I tried this and it works most of the time but I have a few events which are not converting properly.  The posts below indicate that this could be a problem but there doesn't seem to be complete agreement.

Does anyone have a better way of getting the EventID?  One that should always work?

Question by:chlade
    1 Comment
    LVL 41

    Accepted Solution

    There are multiple issues here...

    one is the MSDN documentation correctly indicates that to convert an "Instance ID" to an "Event ID", you just have to mask off the 2 two bits.  This is easly done with a simple "Logical And" operation, like:

       Dim EventID as Integer = Cint(entry.InstanceId and &H3FFFFFFF)

    The second issue is that the Event Viewer doesn't follow the MSDN documentation, and therefore gives a different answer!.   So, if you want the InstanceID to match the EventID as seen in the Event Viewer, you'd need to mask a bit more

       Dim EventID as Integer = Cint(entry.InstanceId and &HFFFF)

    So, the question comes down to:  Do yo want the "correct answer" or the "compatible answer"


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    A while ago, I was working on a Windows Forms application and I needed a special label control with reflection (glass) effect to show some titles in a stylish way. I've always enjoyed working with graphics, but it's never too clever to re-invent …
    Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now