INFO: Win32_NTLogEvent.EventIdentifier Does Not Match the Event ID in Event Viewer (245222)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Workstation 4.0
This article was previously published under Q245222

SUMMARY

The value returned by Win32_NTLogEvent.EventIdentifier does not match the event ID posted in the Event Viewer.

For example, an event may show event ID=9 under Event Viewer, but WMI reports that:

Win32_NTLogEvent.EventIdentifier=3221487625

Or an event may have event ID=3013 under Event Viewer, but WMI reports:

Win32_NTLogEvent.EventIdentifier=2147486661

MORE INFORMATION

Event identifiers are 32-bit values. However, Event Viewer only uses the lower 16 bits in its display.

WMI 1.5 added the EventCode property to the Win32_NTLogEvent class to provide the lower 16 bits of the EventIdentifier value.

For earlier versions of WMI, you can mask the value of EventIdentifier with 0xFFFF to obtain the value shown in Event Viewer.
Modification Type:MajorLast Reviewed:5/14/2003
Keywords:kbinfo KB245222
©2002 Microsoft Corporation. All rights reserved.