Friday, October 31, 2008

Get EventID (Event ID) from InstanceID (EventLogEntry Class)

EventID is an obsolete property. So if you were using this property your question is: How do I get this information alternatively? The Microsoft online help suggests that:
"Two event log entries from the same source can have matching EventID values, but have different InstanceId values due to differences in the top two bits of the event identifier. "

The solution:
int EventID = (int) (Entry.InstanceID & 0x3fff)

Explanation
the EventID is stored in the 14 rightmost bits. '&' is a bitwise operation and 0x3fff is the hex representation of the binary sequence: 0011 (3) 1111 (f) 1111 (f) 1111 (f) this bitwise operation sets all bits other than the 14 rightmost bits to '0'. Et voila!

My rant: "top 2 bits." That's like losing something in a tetradecagon-shaped room and said it was placed in a corner. let me explain to you why:
EventID is an int (32 bits), InstanceID is a long(64 bits). So, is it the top 2 bits of the long or the int? answer: Neither -.-
In fact, EventID is 14 bits, 2 smaller than a short, hence the difference between an EventID and InstanceID is the top 2 bits of a short inside a long that is referenced as an int (what?). But that would mean that InstanceID is a short which it clearly isn't. The writer made a riddle out of a description attempt. When I go to a resource page, I'm looking for clear answers, not riddles.

Tuesday, October 14, 2008

Routines, Procedures, Functions and Methods (Mysql/SQL): What they are, and what they do

As IBM lost 25% of it's value in the past few weeks, I found a very valuable article on their website clearing the semantic mess in my head. The chart is top-notch:
http://publib.boulder.ibm.com/infocenter/db2luw/v8/index.jsp?topic=/com.ibm.db2.udb.doc/ad/c0009145.htm

Wednesday, September 3, 2008

EventLog field types and descriptions

EventLog = string logname
RecordNumber = int position
TimeGenerated =  TimeStamp when the application sent the  event
TimeWritten = TimeStamp when the eventlog processed the event
EventID =  int Error number
EventType = int event type numerical ID{1 = Error event, 2 = Warning event,  4 = Information event} 
EventTypeName = string  event type
EventCategory = int  application/source defined field usually for event organization
EventCategoryName =string application/source defined field
SourceName = string name of application/source
Strings = string application/source field
ComputerName = string name of computer error is coming from
SID = string Security Identifier
Message = string application/source field  usually event description
Data = string application/source field usually Data relating to event