How to map Windows Event Log Event level to a string

Question

Windows event logs are different at below Vista (XP and below) and Vista and up, see here Windows Event Logs . On Vista and up, on the event viewer, we could see a column called Level. If we filter the event, it would show us all the possible levels:

Critical
Warning
Verbose
Error
Information

The value of Information has value 4 based on my testing. However if we look at the schema for Level, actually the range of its values are not restricted. So here are two of my questions:

• how do I know what value each of above string would have? Is there a page at MSDN for this? I could not find it
• Is there any restriction for the Level or not? Or is it up to the Event provider itself?

Answer 1

I hope this link will help you.

As you can see from link above, custom levels values must be in range from 16 to 255, that's mean, that windows levels are placed in range from 0 to 15.