Eventid missing in Framework 2.0

I am upgrading to Visual Studio 2005 and have a problem with the following, hope someone can help me out:

{

EventLog aLogs = new EventLog();

aLogs.Log = "System";

//aLog.MachineName = machine;

aLogs.EntryWritten += new EntryWrittenEventHandler(OnSysEntryWritten);

aLogs.EnableRaisingEvents = true;

}

This was asked before. Here was the final answer.

"Ahh I see where you're getting at I believe. EventID is the actual value that you want but it is deprecated. However EventID is actually InstanceID with the top 2 bits masked off. Therefore if you take the InstanceID and mask off the top 2 bits you'll get the EventID as shown in EV.

entry.EventID == entry.InstanceID & 0x3FFFFFFF
"

Michael Taylor - 2/16/07
http://p3net.mvps.org

Thank you for your response.

I still get some strange values
Entry ID 6011
Entry ID 6009
Entry ID 6005
Entry ID 263
Entry ID 39452806
Entry ID 39452806
Entry ID 1008
Entry ID 20003
Entry ID 20001
Entry ID 1008

The 39452806 are warnings wirh Event ID 134

I don't quite know how to explain the disparent values. One thing I will point out though is that you'll ultimately be getting back an int so you should truncate the InstanceID (which is a long) to an int before doing the binary operation. Maybe this will resolve your issue.

Michael Taylor - 2/17/07
http://p3net.mvps.org

Thanks,

This did it

int EventID = (short)(e.Entry.InstanceId) & 0x3FFFFFFF;

This method does not work for me also. I need to get the exact value as in Event Viewer, from the EventLogEntry object.

If i use the method, mentioned above, I am getting the wrong values in my case.

Any additional way to do it

The original poster was interested in getting the equivalent functionality of EventId and not necessarily lining it up with what Event Viewer showed. Therefore the posted code InstanceId & 0x3FFFFFFF would give them the same value as EventId from v1.1. However InstanceId is a long whereas the original value was an int (not a short) so truncation needs to occur. The OP said that casting to short worked but it should actually be truncated to an int to get the full value like so:

(int)(InstanceId) & 0x3FFFFFFF

This will give the same value as EventId in all cases. Whether that maps back to Event Viewer is a different story altogether but if one is wrong then they both will be.

Michael Taylor - 2/28/07
http://p3net.mvps.org

The problem is, that it simple does not work with me.

I am generating event to be created. Its displayed in Event Log viewer as event 61466.

Same time i am catching the event

I think there is some confusion here so I'll try and explain the details a little better.

Firstly the OP wanted to get equivalent functionality to EventId which was deprecated in v2. The formual: (int)(InstanceId) & 0x3FFFFFFF will give you that.

Secondly the event ID has little meaning and does not match the value shown in EV. It shows you the full ID as defined for the event record. So how do you get the same value from EV Pretty straightforward once you understand the layout.

EV does not show you the actual event ID. Instead it shows you only the code portion of the ID. The code is simply the last 2 bytes of the event ID. So if you want to get the same value as shown in EV then do this: (int)(InstanceId) & 0xFF.

Hope this clarifies things.

Michael Taylor - 2/28/07
http://p3net.mvps.org

Thank you for the help.

The (int)(InstanceId) & 0xFF didnt worked for me thou.

I used the (int)(InstanceId) & 0x3FFFF

and only then got the right results.