Windows NT to Windows XP and Server 2003 kept their event logs in this format.
Microsoft documents the structures: ELF_LOGFILE_HEADER and
ELF_EOF_RECORD in its archived Win32 documentation, and
EVENTLOGRECORD in the winnt.h reference. This page follows
those and Joachim Metz’s libevt documentation, Windows Event Log (EVT) format.
All numbers are little-endian; times are 32-bit counts of seconds since 1970, UTC.
File header
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 4 | HeaderSize | 48 (0x30). |
4 | 4 | Signature | 0x654C664C, the bytes LfLe in the file (Microsoft calls it “ASCII for eLfL”, reading the number big-endian). |
8 | 4 | MajorVersion | 1. |
12 | 4 | MinorVersion | 1. |
16 | 4 | StartOffset | Where the oldest record starts. |
20 | 4 | EndOffset | Where the end-of-file record starts. |
24 | 4 | CurrentRecordNumber | Microsoft: the number of the next record that will be added. (libevt calls it the last, newest record number.) |
28 | 4 | OldestRecordNumber | The number of the oldest record; 0 for an empty file. |
32 | 4 | MaxSize | The maximum size in bytes, set when the log is created; the service relies on the registry rather than updating it. |
36 | 4 | Flags | See flags. |
40 | 4 | Retention | The retention value when the file was created; not normally updated (the registry setting governs). Its unit is not given in either source. |
44 | 4 | EndHeaderSize | 48 again. |
| Flag | Name | Meaning |
|---|---|---|
0x0001 | ELF_LOGFILE_HEADER_DIRTY | Records have been written but the file has not been properly closed. The service sets it before the first write and clears it at shutdown; it resynchronises a dirty live log, and treats a dirty backup log as corrupt. |
0x0002 | ELF_LOGFILE_HEADER_WRAP | Records in the log have wrapped. |
0x0004 | ELF_LOGFILE_LOGFULL_WRITTEN | The most recent write failed for lack of space. |
0x0008 | ELF_LOGFILE_ARCHIVE_SET | The file’s archive attribute has been set. |
Event record
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 4 | Length | The record’s size in bytes, including the padding. |
4 | 4 | Reserved | Always ELF_LOG_SIGNATURE, 0x654C664C. |
8 | 4 | RecordNumber | The record’s number. |
12 | 4 | TimeGenerated | When the entry was submitted. |
16 | 4 | TimeWritten | When the service received it to write to the log. |
20 | 4 | EventID | The event identifier, specific to the source; see event ID. |
24 | 2 | EventType | See event types. |
26 | 2 | NumStrings | Number of message strings. |
28 | 2 | EventCategory | Category, specific to the source. |
30 | 2 | ReservedFlags | Reserved (Microsoft). libevt: a copy of the flags passed to the ElfrReportEvent call of [MS-EVEN]. |
32 | 4 | ClosingRecordNumber | Reserved. |
36 | 4 | StringOffset | Where the strings start, from the start of the record. |
40 | 4 | UserSidLength | Size of the user’s SID; 0 if none. |
44 | 4 | UserSidOffset | Where the SID is, from the start of the record. |
48 | 4 | DataLength | Size of the binary data; 0 if none. |
52 | 4 | DataOffset | Where the data is. |
56 | varies | SourceName | The event source’s name, a WCHAR string with a terminating zero. |
| … | varies | Computername | The computer that generated the event, the same way; may be followed by padding so the SID is on a 4-byte boundary. |
| … | varies | UserSid | The active user’s security identifier, binary; may be empty when UserSidLength is 0. |
| … | varies | Strings | NumStrings WCHAR strings: the replacement strings merged into the source’s message text. |
| … | varies | Data | Event-specific binary data. |
| … | 0–3 | Pad | To a multiple of 4. |
| end − 4 | 4 | Length | The record’s size again, so the log can be read backwards. |
The message shown in Event Viewer is not in the file: the event ID, source name and
a language identify a string in the message file registered for the source, and the
strings are merged into it (Microsoft, EVENTLOGRECORD remarks).
Event types
| Value | Name | Meaning |
|---|---|---|
0x0001 | EVENTLOG_ERROR_TYPE | Error |
0x0002 | EVENTLOG_WARNING_TYPE | Warning |
0x0004 | EVENTLOG_INFORMATION_TYPE | Information |
0x0008 | EVENTLOG_AUDIT_SUCCESS | Success audit |
0x0010 | EVENTLOG_AUDIT_FAILURE | Failure audit |
These are the five types in Microsoft’s EVENTLOGRECORD reference and
libevt.
Event ID
The 32-bit event ID is laid out like a message identifier: the number most programs show is only its low 16 bits.
| Bits | Field |
|---|---|
| 0–15 | Code: the event number shown to users |
| 16–27 | Facility |
| 28 | Reserved |
| 29 | Customer: 1 for an application-defined code, 0 for a Microsoft one |
| 30–31 | Severity: 0 success, 1 informational, 2 warning, 3 error |
End-of-file record and wrapping
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 4 | RecordSizeBeginning | 40 (0x28). |
4 | 16 | One … Four | 0x11111111, 0x22222222, 0x33333333, 0x44444444. |
20 | 4 | BeginRecord | Offset of the oldest record (as in the header). |
24 | 4 | EndRecord | Offset of this end-of-file record. |
28 | 4 | CurrentRecordNumber | The next record number. |
32 | 4 | OldestRecordNumber | The oldest record number. |
36 | 4 | RecordSizeEnd | 40 again. |
The end-of-file record follows the newest record, or the header when the log is
empty, and lets the service rebuild the header (Microsoft). Records start at
StartOffset, and the log can wrap (the WRAP flag); neither
source read for this page describes exactly how a record is placed when it reaches
the end of the file. libevt notes that a dirty file’s offsets may point to the wrong
places, that readers should then look for the end-of-file record after the stated
offset, and that a wrapped dirty file can have trailing data after the last event
before the wrap, which is to be ignored.
Example
00000000 30 00 00 00 4C 66 4C 65 01 00 00 00 01 00 00 00 0...LfLe........Reading it: header size 48, signature LfLe, version 1.1.