Windows EventRecord C# API has an issue with RecordId types

Sam light 6 Reputation points
2022-03-22T09:35:53.927+00:00

The issue is that, Windows Event Viewer has a Unique attribute to identify a Record Separately called EventRecordID which has a unsignedLong as type, and to query that in C# Windows gave an API called EventLogReader using which you can read all the data as EventRecord in that they have that unique ID as RecordId which has a type Int64 according to the docs:

  1. signed long has a range from: -9,223,372,036,854,775,808 to 9,223,372,036,854,775,807
  2. unsigned long has a range from 0 to 18,446,744,073,709,551,615
    For further reading on the data types: https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventrecord.recordid?view=dotnet-plat-ext-6.0
    Is there any known way to fix this issue?
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,198 questions
C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,996 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Jack J Jun 24,516 Reputation points Microsoft Vendor
    2022-03-23T06:51:23.743+00:00

    @Sam light , based on my research, I find the doc indeed has the problem. According to my further detect, I find that the win32 doc is correct.

    The following are some explanations:

    in C/C++:

    unsignedLong->range: 0~4,294,967,295

    in C#:

    long->range:
    -9,223,372,036,854,775,808 ~ 9,223,372,036,854,775,807

    uint->range:

    0~ 4,294,967,295

    Thefore, the doc should be changed to the following:
    Based on the microsoft doc Event Log Records, the minium is 0.

    public abstract uint? RecordId { get; }

    Property Value
    Nullable<Int32>
    Returns a uint value. This value can be null.

    As for long is larger than uint, so it will not affect you to get the recordid currently.

    However, Looks like the doc can be improved, I will help to report and improve this doc to be correct.

    Thanks for your reporting.

    Best Regards,
    Jack


    If the answer is the right solution, please click "Accept Answer" and upvote it.If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.