EventID ?? is now InstanceID

Guys,

On VB 2005 microsoft had the wonderfull idea of change the Eventid for InstanceID. I'm trying of retrieve the eventid in my application but it come with a very long number in some cases. How can I retrieve the EventID that you can see in the Event Viewer instead of the InstanceID Is there a way I can convert the InstanceID to EventID

Ejemple:

Private Sub btnSee_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnFind.Click

' Create an EventLog instance and assign its source.

'Dim myLog As New EventLog("myNewLog", ".", "MySource")

Dim entry As EventLogEntry

For Each entry In EventLog1.Entries

Console.WriteLine(entry.InstanceId) ' here I got a long number instead the usual 4 or 5 digit number you can see in the event viewer.

Console.WriteLine(entry.Source & vbCrLf)

Next

End Sub

Thanks in advance for your help.

Answer this question

EventID ?? is now InstanceID

voko

This might give you the results your'e expecting, but it's not actually correct - luck is playing a large part. Your bitmask there equates to 11111111111111110001, which is way way off :)

Do you want me to send you my actual VS project so you can run my code without danger of cut and paste messups If so, send me your email address - either post it on here, or use the contact link on my blog if you don't to publish it for everyone to see: http://codebetter.com/blogs/geoff.appleby/contact.aspx
Nate Dunlap

Hi,

According to the MSDN library, the eventid can be derived from the instanceid using masking:

The InstanceId property uniquely identifies an event entry for a configured event source. The InstanceId for an event log entry represents the full 32-bit resource identifier for the event in the message resource file for the event source. The EventID property equals the InstanceId with the top two bits masked off. Two event log entries from the same source can have matching EventID values, but have different InstanceId values due to differences in the top two bits of the resource identifier.

So to do this, you'd need to do something like:

Dim entry As EventLogEntry

Dim lEventID As Int32

For Each entry In EventLog1.Entries

Debug.WriteLine(entry.InstanceId)

'Take just the integer part of the instanceid

lEventID = CInt(entry.InstanceId And CLng(Int32.MaxValue))

'Wipe out the top two bits

lEventID = (lEventID And &H3FFFFFFF)

'write out the eventid

Debug.WriteLine(lEventID.ToString)

Debug.WriteLine(entry.Source & vbCrLf)

Next

This should give you what you're after :)
Allison
Dear Prjuanl,

I've found that the best way to understand and convert between hexadecimal, decimal and binary is using the Calculator applet as follows:

Under View ensure that the Scientific option is clicked

To convert hexadecimal &H3FFFFFFF (the &H prefix means its hexadecimal) to its binary form, choose the Hex radio button and either paste in or use the screen-keypad to type in the hexadecimal portion, ie type in "FFFFFFF".

Then choose the Bin radiobutton to display the value in its binary form - note that the number is read from the far right (low order bit) to the far left (high order bit) and that any zero high bits are not displayed, Ie 00111111111111111111111111111111 is displayed as 111111111111111111111111111111. By Anding this mask with your ID you are effectively setting the highest two bits to zero.

Hope this helps you in understanding hexadecimal and binary.
Ender Uygun

Hi Geoff,

This code work but is not a 100% accurate. In the event log I have the EventID 4 and when I run the code give me 537001988. Any idea were I can go to learn more about Event Log, any book or other reference I will like to know also from were you get the &H3FFFFFFF and what it means I tought that make a event log Search\filter was easy but is a lot harder I thought.

Thanks a lot!!!

PRJUANL
Jenny Lo - MSFT

Ok,

Here is the code that work for me.

Private Sub btnFind_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnFind.Click

Dim lEventID As Integer

Dim entry As EventLogEntry

Dim Message As String

For Each entry In EventLog1.Entries

lEventID = (entry.InstanceId And &HFFFFI) 'This Type Character was the one that work for me.

If lEventID = 4 Then

Message = lEventID.ToString & vbCrLf _

& entry.Source.ToString & vbCrLf _

& entry.EntryType.ToString & vbCrLf _

& entry.Category.ToString & vbCrLf _

& entry.Message.ToString & vbCrLf

Console.WriteLine(Message)

End If

Next

End Sub

Thanks you!!!
Shotmaker

References I can't give, I dont' know that much myself.

It's strange that that code doesn't work, i've run it on two different computers now and it comes up fine. Are you sure you're running my code exactly as I gave it

the &H3FFFFFFF is a number represented in Hex. In binary it would look like two zeros followed by thirty ones. By ANDing it with the instanceid (once converted to an integer from a long) you're obtaining just the right-most 30 bits of the instanceid, which is what it says should be done in the doco.
EventID ?? is now InstanceID

Answer this question