• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1313
  • Last Modified:

Event ID - how to derive from Instance ID

I have a question regarding the Event ID in the Event Log.  I wrote a program that will read through events and update a database with event log information.  It appears that .NET only allows you to grab the InstanceID and that you must convert it to the Event ID that you see in the log.

Is there a 100%, guaranteed-to-work, method of getting the Event ID?

The following link has a discussion on this.  The second post in the link gives a VB routine that does the conversion.  I tried this and it works most of the time but I have a few events which are not converting properly.  The posts below indicate that this could be a problem but there doesn't seem to be complete agreement.


Does anyone have a better way of getting the EventID?  One that should always work?

1 Solution
There are multiple issues here...

one is the MSDN documentation correctly indicates that to convert an "Instance ID" to an "Event ID", you just have to mask off the 2 two bits.  This is easly done with a simple "Logical And" operation, like:

   Dim EventID as Integer = Cint(entry.InstanceId and &H3FFFFFFF)

The second issue is that the Event Viewer doesn't follow the MSDN documentation, and therefore gives a different answer!.   So, if you want the InstanceID to match the EventID as seen in the Event Viewer, you'd need to mask a bit more

   Dim EventID as Integer = Cint(entry.InstanceId and &HFFFF)

So, the question comes down to:  Do yo want the "correct answer" or the "compatible answer"

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now