Categories help you organize events so Event Viewer can filter them. Each event source can define its own numbered categories and the text strings to which they are mapped.
The categories must be numbered consecutively, beginning with the number 1. The categories themselves are defined in a message file. For example, use the following syntax to declare three event categories. In Event Viewer, the events that use these categories will have Category 1, Category 2, or Category 3 displayed in the Category column.
MessageId=0x1 SymbolicName=CATEGORY_1 Language=English Category 1 . MessageId=0x2 SymbolicName=CATEGORY_2 Language=English Category 2 . MessageId=0x3 SymbolicName=CATEGORY_3 Language=English Category 3 .
Categories can be stored in a separate message file, or in a file that contains messages of other types. If you create a single message file, be sure that the categories are the first messages in the file. For more information on creating and using message files, see Message Files.
The total number of categories is stored in the CategoryCount value for the event source.