Inconsistent Descriptions When Using Event Viewer

• Microsoft Windows NT Workstation versions 3.5, 3.51, and 4.0
• Microsoft Windows NT Server versions 3.5, 3.51, and 4.0

SYMPTOMS

When you use Event Viewer located in Administrative Tools, the event viewer may display different description information under Event Details for the same event ID number. This problem occurs when either viewing an event log of a remote computer or viewing a log file saved from a different computer locally.

CAUSE

When an event is triggered in Windows NT, the event ID is written to the log file, not the event description. Because of updated ERROR_CODEs and improvements to Windows NT through service packs, the order and description codes have changed.

When an event is triggered in Windows NT, the ID number of the event is written to the log file to minimize the size of the log file, the text description corresponding to the ID is not written to the log file but is looked up in a .dll file when the event is opened. The .dll file that is used is dependent on the event. As a result, when the event viewer is run, a lookup of the event ID is referenced locally and the appropriate event ID text is displayed. This can cause an event to have multiple meanings according to the versions of the system and event log that is running.

RESOLUTION

To avoid inconsistent error messages when reading the event log of a remote computer, make sure all systems match according to version number and service pack level. This can be verified by running WINMSD from within Windows NT and selecting Version.