Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Each event can have event-specific data associated with it. The Event Viewer does not interpret this data; it displays extra data only in a combined hexadecimal and text format. The maximum limit on the size of an event in the event log is 0x3FFFF bytes. Therefore, use event-specific data sparingly, including it only if you are sure it will be useful to someone debugging a problem. For example, many network-related events include network control blocks (NCB) as event-specific data.
When you use event-specific data, the last part of its description string should provide a note about the information provided as event-specific data. For example, the network software could provide a note such as: "(The NCB is the event data.)" As a convention, use parentheses around such remarks, as indicated in this example.
You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the log and creates a report that includes information from the event-specific data.