EventRecordID what happens when it reaches its max size, does it wrap around to start again from 0

Question

So I've been trying to query the Windows EventViewer and it got me thinking that what happens when it reaches the max size of 18,446,744,073,709,551,615 does it wrap around and start again from 0? if that does happen how will I query EventViewer with EventRecordID since starting again from EventRecordID to > 0 will again fetch the beginning data as well as the wrapped around data?

Answer 1

Hello @Sam light

Thank you for this metaphysical question. There is absolutely no documentation to the respect, and the limit is related to 2^64-1 as a calculation in binary of 64bit (equals to 1111111111111111111111111111111111111111111111111111111111111111b). The reason why this limit is not tested is that even if each ID information was only 1Kb of space, the total amount will be measured in Zettabytes (or millions of Terabytes).

A scientific estimation in 2018 about the world´s total combined digital storage predicts that it would be around 175 Zettabytes by 2025. This Event viewer would take 10% of it.

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--