Event Schema Elements
The following are the elements that the Event schema defines. This section contains the names of the elements that you would find in a logged event; however, to get the details for each element, see the complex type that contains the element.
| Element | Description |
|---|---|
| BinaryEventData (EventType) | Contains the event data as a binary blob. |
| Binary (EventDataType) | A binary data blob for events that are written using Event Logging. |
| Channel (RenderingInfoType) | The rendered message string of the channel specified in the event. |
| Channel (SystemPropertiesType) | The channel to which the event was logged. |
| ComplexData (EventDataType) | A structure that is defined in the template for the event. |
| Component (DebugDataType) | The name of the component that logged the trace message. |
| Computer (SystemPropertiesType) | The name of the computer on which the event occurred. |
| Correlation (SystemPropertiesType) | The activity identifiers that consumers can use to group related events together. |
| DataItemName (ProcessingErrorDataType) | Contains the name of the event data item that caused an error when the event data was processed. |
| Data (ComplexDataType) | The list of data items in the structure. The list of items are in the same order as defined in the template. |
| Data (EventDataType) | A top-level data item that is defined in the template for the event. |
| DebugData (EventType) | Contains the data that can be logged for Windows software trace preprocessor (WPP) events. |
| ErrorCode (ProcessingErrorDataType) | Contains the error code that was raised when there was an error processing event data. |
| Event | This is the root node of the rendered event data. |
| EventData (EventType) | Contains the event data. |
| EventID (SystemPropertiesType) | The identifier that the provider used to identify the event. |
| EventPayload (ProcessingErrorDataType) | Contains binary event data for the event that caused an error when the event data was processed. |
| EventRecordID (SystemPropertiesType) | The record number assigned to the event when it was logged. |
| Execution (SystemPropertiesType) | Contains information about the process and thread that logged the event. |
| FileLine (DebugDataType) | The name of the source file and the line within the source file that logged the trace message. |
| FlagName (DebugDataType) | The flag value passed to the provider when it was enabled. |
| Function (DebugDataType) | The name of the function that logged the trace message. |
| Keyword (Keywords) | Contains a rendered keyword. |
| Keywords (RenderingInfoType) | A list of rendered keywords. |
| Keywords (SystemPropertiesType) | A bitmask of the keywords defined in the event. |
| LevelName (DebugDataType) | The level value passed to the provider when it was enabled. |
| Level (RenderingInfoType) | The rendered message string of the level specified in the event. |
| Level (SystemPropertiesType) | Contains the severity level of the event. |
| Message (DebugDataType) | The message string. The XML contains this element if the WPP event specified the FormattedString field. |
| Message (RenderingInfoType) | Contains the event message that is rendered for the event. |
| Opcode (RenderingInfoType) | The rendered message string of the opcode specified in the event. |
| Opcode (SystemPropertiesType) | The opcode defined in the event. |
| ProcessingErrorData (EventType) | Contains details of the error that occurred while trying to render the event. |
| Provider (SystemPropertiesType) | Identifies the provider that logged the event. |
| Provider (RenderingInfoType) | The rendered message string for the provider. |
| RenderingInfo (EventType) | Contains the rendered message strings for the event (includes the event's message string and the message strings for any of the event's properties such as level, task, and opcode). |
| Security (SystemPropertiesType) | Identifies the user that logged the event. |
| SequenceNumber (DebugDataType) | The local or global sequence number of the trace message. |
| SubComponent (DebugDataType) | Specifies the SubComponentName WPP debug tracing field that is used in debug events in debug channels. |
| System (EventType) | Contains information that identifies the provider and how it was enabled, the event, the channel to which the event was written, and system information such as the process and thread IDs. |
| Task (RenderingInfoType) | The rendered message string of the task specified in the event. |
| Task (SystemPropertiesType) | The task defined in the event. |
| TimeCreated (SystemPropertiesType) | The time stamp that identifies when the event was logged. |
| UserData (EventType) | Contains the event data. |
| Version (SystemPropertiesType) | Contains the version number of the event's definition. |