When an application calls the ReportEvent function to write an entry to the log, Windows NT passes the parameters to the event-logging service. The event-logging service uses the information to write an EVENTLOGRECORD structure to the event log. The following diagram illustrates this process.