Search code examples
c#.netevent-log

Testing to see if casting (Uint16) on EventID(deprecated) will be valid?


old code: if (eventArguments.Entry.EventID == 1074)

The EventID is deprecated. According to this I can change it to this: to

(UInt16)eventArguments.Entry.InstanceId == 1074

I'm trying to make a console application to test this. Can anyone help or give me some guidance?

edit- here is what I have so far and I think it's enough?

            Dictionary<string, EventLog> logList = new Dictionary<string, EventLog>();
        foreach (EventLog log in EventLog.GetEventLogs())
            logList.Add(log.LogDisplayName, log);

        foreach (EventLogEntry entry in logList["Application"].Entries)
        {
            long instanceID = entry.InstanceId;
            long eventID = entry.EventID;
            long calculatedEventID = entry.InstanceId & 0x3fffffff;
            //long calculatedEventID = (UInt16)entry.InstanceId;
            if (eventID != calculatedEventID)
                Console.WriteLine("{0}, {1}, {2}", eventID, instanceID, calculatedEventID);
            else
            {
                Console.WriteLine("calculatedEventID is {0} ", calculatedEventID);
            }
        }

Solution

  • In order to guarantee the result you're looking for, you'll need this:

    if (eventArguments.Entry.InstanceId & 0x3FFFFFFF == 1074)
    

    You can browse the .NET Framework Source to find this out. Specifically, here's the source code for EventLogEntry. This is the code for the EventID property:

    public int EventID {
        get {
            // Apparently the top 2 bits of this number are not
            // always 0. Strip them so the number looks nice to the user.
            // The problem is, if the user were to want to call FormatMessage(),
            // they'd need these two bits.
            return IntFrom(dataBuf, bufOffset + FieldOffsets.EVENTID) & 0x3FFFFFFF;
        }
    }
    

    Here's the code for InstanceId:

    public Int64 InstanceId {
        get {
            return (UInt32)IntFrom(dataBuf, bufOffset + FieldOffsets.EVENTID);
        }
    }