<div class="content" name="EVENTLOGRECORD" uuid="541de33d-cee4-4c16-976c-e1e2ea152e65"><p>The EVENTLOGRECORD structure contains information on a
single event. This structure is transferred as a set of bytes in the buffer
passed in the <a href="1898e85b-10a1-43b9-a27e-92fc833cebea" data-linktype="relative-path">ElfrReadELW (section 3.1.4.7)</a>
and <a href="a9c60290-49d1-4f3f-808d-14897d20bb1f" data-linktype="relative-path">ElfrReadELA (section 3.1.4.8)</a>
methods. </p><p>All integer fields in the EVENTLOGRECORD structure MUST be
in little-endian byte order (that is, least significant byte first). </p><p>The string fields in this structure MUST be ANSI strings
when this structure is used with ElfrReadELA (section 3.1.4.8)
methods, and <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a>
strings when this structure is used with
ElfrReadELW (section 3.1.4.7) methods.</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">Length</td>
 </tr>
 <tr>
  <td colspan="32">Reserved</td>
 </tr>
 <tr>
  <td colspan="32">RecordNumber</td>
 </tr>
 <tr>
  <td colspan="32">TimeGenerated</td>
 </tr>
 <tr>
  <td colspan="32">TimeWritten</td>
 </tr>
 <tr>
  <td colspan="32">EventID</td>
 </tr>
 <tr>
  <td colspan="16">EventType</td>
  <td colspan="16">NumStrings</td>
 </tr>
 <tr>
  <td colspan="16">EventCategory</td>
  <td colspan="16">ReservedFlags</td>
 </tr>
 <tr>
  <td colspan="32">ClosingRecordNumber</td>
 </tr>
 <tr>
  <td colspan="32">StringOffset</td>
 </tr>
 <tr>
  <td colspan="32">UserSidLength</td>
 </tr>
 <tr>
  <td colspan="32">UserSidOffset</td>
 </tr>
 <tr>
  <td colspan="32">DataLength</td>
 </tr>
 <tr>
  <td colspan="32">DataOffset</td>
 </tr>
 <tr>
  <td colspan="32">SourceName (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Computername (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">UserSidPadding (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">UserSid (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Strings (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Data (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Padding (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Length2</td>
 </tr>
</tbody></table><p><b>Length (4 bytes): </b>Size in bytes of the
structure. The size varies depending on the variable-length fields at the end of
the structure.</p><p><b>Reserved (4 bytes): </b>MUST be set to 0x654c664C
(which is ASCII for eLfL). This serves as a signature for the structure.</p><p><b>RecordNumber (4 bytes): </b>The record number, as
defined in section <a href="68de6374-4d17-4c49-8ec7-f328b79ddd65" data-linktype="relative-path">1.3.1</a>.
The <b>RecordNumber</b> is mapped directly from the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_86fdb9db-1f9d-4e4a-bec5-bfcd3b9f6159" data-linktype="relative-path">record ID</a>. The record ID is
an unsigned int64 (an 8 byte number) that the server reads from the file and
converts to an unsigned integer (a 4 byte number) when assigning the value to
the <b>RecordNumber</b> field in the <b>EVENTLOGRECORD</b> structure. The
conversion simply discards the higher 32 bits of Record ID and assigns the
lower 32 bits of record ID to the <b>RecordNumber</b>.</p><p><b>TimeGenerated (4 bytes): </b>Time when the event
was generated. The time MUST be expressed as the number of seconds since
00:00:00 on January 1, 1970 (UTC). This value is supplied by the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_efdc035d-100a-4568-a67f-69fb726fadcb" data-linktype="relative-path">event source</a>.</p><p><b>TimeWritten (4 bytes): </b>Time when the event was
written. The time MUST be expressed as the number of seconds since 00:00:00 on
January 1, 1970 (UTC). This value is the time the event was written to the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a>.</p><p><b>EventID (4 bytes): </b><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_edce565a-e2b7-40df-ab78-cbb3a49ff3bd" data-linktype="relative-path">EventID</a> generated by the
event source, as specified in section <a href="8db98779-8bf4-442c-8d1b-cba2dbf1b365" data-linktype="relative-path">1.8.4</a>.</p><p><b>EventType (2 bytes): </b>Type of the event, as
specified in section 1.3.1. </p><p><b>NumStrings (2 bytes): </b>Number of strings in the
<b>Strings</b> field. This MUST be between 0 and 256, inclusive. A value of
zero indicates that no strings are present. </p><p><b>EventCategory (2 bytes): </b><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_218d3b23-9c27-45d5-a861-7b832d392fc6" data-linktype="relative-path">Event category</a>, as
specified in section <a href="c1f99c2e-b118-45e1-a414-007272fb9d43" data-linktype="relative-path">1.8.5</a>.
</p><p><b>ReservedFlags (2 bytes): </b>Specifies whether or
not the last string in the <b>Strings</b> field contains well-formed XML, as
specified in <a href="https://go.microsoft.com/fwlink/?LinkId=90598" data-linktype="external">[XML]</a>.
This MUST be one of the following two values. </p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x0000</td>
  <td>The event does not contain XML.</td>
 </tr><tr>
  <td>0x8000</td>
  <td>The event contains XML.</td>
 </tr></tbody></table>
</dd></dl><p><b>ClosingRecordNumber (4 bytes): </b>MUST be set to
zero when sent and MUST be ignored on receipt.</p><p><b>StringOffset (4 bytes): </b>This MUST be the
offset in bytes from the beginning of the structure to the <b>Strings</b>
field. If the <b>Strings</b> field is not present (NumStrings is zero), this
can be set to any arbitrary value when sent and MUST be ignored on receipt by
the client.</p><p><b>UserSidLength (4 bytes): </b>Size in bytes of the
user&#39;s security identifier, which is located within the <b>UserSid</b> field.
If there is no <b>UserSid</b> field for this event, this field MUST be set to
zero. </p><p><b>UserSidOffset (4 bytes): </b>This MUST be the
offset in bytes from the beginning of the structure to the <b>UserSid</b>
field. If the <b>UserSid</b> field is not present (that is, if <b>UserSidLength</b>
is zero), this can be set to any arbitrary value when sent and MUST be ignored
by on receipt the client. </p><p><b>DataLength (4 bytes): </b>This MUST be the size in
bytes of the <b>Data</b> field. If the <b>Data</b> field is not used, this
field MUST be set to zero.</p><p><b>DataOffset (4 bytes): </b>This MUST be the offset
in bytes from the beginning of the structure to the <b>Data</b> field. If the <b>Data</b>
field is not present (that is, if <b>DataLength</b> is zero), this can be set
to any arbitrary value when sent and MUST be ignored on receipt by the client.</p><p><b>SourceName (variable): </b>Variable-length
null-terminated string that specifies the name of the source that generated the
event, as defined in section <a href="c32280b0-471d-41b7-b146-7ac496708c26" data-linktype="relative-path">1.8.2</a>.
The length of this field is calculated by seeking the NULL that terminates the
string.</p><p><b>Computername (variable): </b>Variable-length null-terminated
string that assists in identifying the machine that generated the event. This
string MUST NOT<a id="Appendix_A_Target_8"></a><a aria-label="Product behavior note 8" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_8" data-linktype="relative-path">&lt;8&gt;</a> be interpreted by the protocol,
and can be in an arbitrary format. </p><dl>
<dd>
<p>In practice, the name of the computer. There are no
character restrictions on this field&#39;s content (for example, a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_1769aec9-237e-44ed-9014-1abb3ec6de6e" data-linktype="relative-path">fully qualified domain name
(FQDN)</a> can be used).</p>
</dd>
<dd>
<p>The length of this field is calculated by seeking
the NULL that terminates the string.</p>
</dd></dl><p><b>UserSidPadding (variable): </b>MUST be zero or
more bytes of padding, where the choice of length is implementation dependent.
The padding can have any value, and MUST be ignored on receipt.<a id="Appendix_A_Target_9"></a><a aria-label="Product behavior note 9" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_9" data-linktype="relative-path">&lt;9&gt;</a></p><p><b>UserSid (variable): </b>Current user&#39;s security
identifier, as defined by the <a href="6f5fd814-09e4-4ca0-8e47-1383ddf9ea91" data-linktype="relative-path">RPC_SID</a> structure. This
parameter can be NULL if the security identifier is not required. </p><p><b>Strings (variable): </b>Zero or more
null-terminated strings containing information on the event. The <b>NumStrings</b>
field contains the number of items in this field.</p><p><b>Data (variable): </b>Event-specific binary data.
This is supplied by the event source, and MUST NOT be interpreted by the
protocol. This data is not always present. The <b>DataLength</b> field contains
the length of this field. The <b>DataOffset</b> field contains the start of
this field.</p><p><b>Padding (variable): </b>The <b>SourceName</b>, <b>ComputerName</b>,
<b>UserSid</b>, <b>Strings</b>, and <b>Data</b> fields can all vary in length.
The <b>UserSid</b>, <b>Strings</b>, and <b>Data</b> fields MAY be zero bytes in
length. The length of the entire structure up to this point, including these
fields, MUST be divisible by 4. Therefore, up to 3 bytes of padding MUST be
added to bring the length to a multiple of 4. The padding can have any value,
and MUST be ignored on receipt.</p><p><b>Length2 (4 bytes): </b>Same value as the Length
field specified as the first member. By having two copies, a buffer containing
many events can easily be navigated in both directions.</p></div>