What event id to use for my custom event log entries? What event id to use for my custom event log entries? windows windows

What event id to use for my custom event log entries?


EventIds are application specific so you can use whatever ranges you like. Just ensure you document what you have used and where so that you can ensure you don't use an id twice, or to facilitate easier debugging.

But keep in mind...

Like when Henry Ford said "you can have any color you want as long as it's black" - you can also use whatever range you like as long as that range falls inside the range of 0 and 65535.


Sure enough, it is up to the author to define and track event IDs they use and what they mean.

Here is a reference: http://msdn.microsoft.com/en-us/library/e29k5ebc.aspx - Particularly interesting is the part about not writing messages with IPv6 addresses (because of the % character) to the event log. I bet you can use a parameter to work around that though.


The hi bits of the ID are reserved for testing, debug and other flags used for development. The usable bits are:

0x0000 - 0xffff

See: Event Message Structure

The upper bits should be avoided but all values for the bottom bits are available if you create a custom source. If you use a system or pre-existing source you will collide and likely get the wrong message. Messages are taken from the registered sources message DLL file. A custom message file can be built using the message file compiler from the SDK.