old code: if (eventArguments.Entry.EventID == 1074)
The EventID is deprecated. According to this I can change it to this: to
(UInt16)eventArguments.Entry.InstanceId == 1074
I'm trying to make a console application to test this. Can anyone help or give me some guidance?
edit- here is what I have so far and I think it's enough?
Dictionary<string, EventLog> logList = new Dictionary<string, EventLog>();
foreach (EventLog log in EventLog.GetEventLogs())
logList.Add(log.LogDisplayName, log);
foreach (EventLogEntry entry in logList["Application"].Entries)
{
long instanceID = entry.InstanceId;
long eventID = entry.EventID;
long calculatedEventID = entry.InstanceId & 0x3fffffff;
//long calculatedEventID = (UInt16)entry.InstanceId;
if (eventID != calculatedEventID)
Console.WriteLine("{0}, {1}, {2}", eventID, instanceID, calculatedEventID);
else
{
Console.WriteLine("calculatedEventID is {0} ", calculatedEventID);
}
}
In order to guarantee the result you're looking for, you'll need this:
if (eventArguments.Entry.InstanceId & 0x3FFFFFFF == 1074)
You can browse the .NET Framework Source to find this out. Specifically, here's the source code for EventLogEntry
. This is the code for the EventID
property:
public int EventID {
get {
// Apparently the top 2 bits of this number are not
// always 0. Strip them so the number looks nice to the user.
// The problem is, if the user were to want to call FormatMessage(),
// they'd need these two bits.
return IntFrom(dataBuf, bufOffset + FieldOffsets.EVENTID) & 0x3FFFFFFF;
}
}
Here's the code for InstanceId
:
public Int64 InstanceId {
get {
return (UInt32)IntFrom(dataBuf, bufOffset + FieldOffsets.EVENTID);
}
}