Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
Event Data

Event Data

Each event can have event-specific data associated with it. The Event Viewer does not interpret this data; it displays extra data only in a combined hexadecimal and text format. The maximum limit on the size of an event in the even log is 0x3FFFF bytes. Therefore, use event-specific data sparingly, including it only if you are sure it will be useful to someone debugging a problem. For example, many network-related events include network control blocks (NCB) as event-specific data.

When you use event-specific data, the last part of its description string should provide a note about the information provided as event-specific data. For example, the network software could provide a note such as: "(The NCB is the event data.)" As a convention, use parentheses around such remarks, as indicated in this example.

You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the log and creates a report that includes information from the event-specific data.



Community Additions

© 2015 Microsoft