Microsoft KB Archive/245222

= INFO: Win32_NTLogEvent.EventIdentifier Does Not Match the Event ID in Event Viewer =

Article ID: 245222

Article Last Modified on 3/1/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition

-



This article was previously published under Q245222



SUMMARY
The value returned by Win32_NTLogEvent.EventIdentifier does not match the event ID posted in the Event Viewer.

For example, an event may show event ID=9 under Event Viewer, but WMI reports that:

Win32_NTLogEvent.EventIdentifier=3221487625

Or an event may have event ID=3013 under Event Viewer, but WMI reports:

Win32_NTLogEvent.EventIdentifier=2147486661



MORE INFORMATION
Event identifiers are 32-bit values. However, Event Viewer only uses the lower 16 bits in its display.

WMI 1.5 added the EventCode property to the Win32_NTLogEvent class to provide the lower 16 bits of the EventIdentifier value.

For earlier versions of WMI, you can mask the value of EventIdentifier with 0xFFFF to obtain the value shown in Event Viewer.

Additional query words: Win32_NTLogEvent event EventIdentifier "Event ID" WMI WBEM

Keywords: kbinfo KB245222

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.