1.8.1 Error Values
Any nonzero return value can represent an error. Vendors SHOULD use the values from the NTSTATUS number space, as specified in [MS-EERR].
The EventLog Remoting Protocol uses NTSTATUS values, as specified in [MS-ERREF] section 2.3.Vendors SHOULD use these values with their indicated meanings.<2>Vendors are free to choose their own values for this field as long as the C bit (0x20000000) is set, indicating that it is a customer code.