RE: Weird event log ids

[Scott Campbell]

Oh boy—my ignorance could show through here J This is my guess, note, ONLY A GUESS, at what COULD be happening.  It’s been a long time since my computer science classes, and documentation on this stuff is non-existent. But here I go (anyone may certainly correct me on my blunders):   This does a "binary AND", not to be confused with a "&&", or "Logical AND".   A logical AND (&&) would be used in a statement, something like "if($this && $that)".   A binary AND works like this:   Suppose you have two numbers, in binary 1st: base 2(binary)=0011 or base 10(decimal)=3 2nd: base 2(binary)=1010 or base 10(decimal)=10   If we do a binary AND on these 2 numbers, we get 0010: 1010 0011 ----- 0010   In binary, the result ANDed is true ONLY if both placeholders are 1's. In this example, our end result is base 2(binary)=0010 or base 10(decimal)=2.   0xffff is hex for the binary equivilant of 16 1’s.   So in our eventlog issue, the number was -1073740770.  I can only assume that possibly this is coming from the MS box as a signed int (the left-most binary place holder signifies +/-), or something to that effect.  Doing the binary AND is just cleaning up the data, and making it a normal readable number like we are used to seeing.   Clear as mud?  I could be way out in left field.  If anyone else has a better idea, I’m all ears.  But I do know this: it worksJ.       Scott Campbell Senior Software Developer Somix Technologies http://www.somix.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Martin, Greg (CSC) Sent: Thursday, March 06, 2003 11:37 AM To: [EMAIL PROTECTED] Subject: RE: Weird event log ids   Scott, for those of us math-impaired readers, could you explain what's happening?   \\Greg -----Original Message----- From: Scott Campbell [mailto:[EMAIL PROTECTED] Sent: Thursday, March 06, 2003 9:41 AM To: 'Foster, Ken'; [EMAIL PROTECTED] Subject: RE: Weird event log ids Try "&"ing your value with 0xffff, like this:   $event_id= $EventData->{'EventID'}  & 0xffff;   This should fix your problem that you are seeing.     Scott Campbell Senior Software Developer Somix Technologies http://www.somix.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Foster, Ken Sent: Thursday, March 06, 2003 9:28 AM To: '[EMAIL PROTECTED]' Subject: Weird event log ids   I am reading Event logs from a Windows XP PC, and the ID shown in my Perl script is very different than the ID listed by Microsoft or shown in their GUI tool. For example, when I look for event ID 1704, my perl script reports the ID as 1073743528; similarly,  event ID 1054 is reported by Perl as -1073740770.  Any ideas on why this is happening or how I can map the Perl numbers back to the original Microsoft ID?   Thanks.   -Ken Foster   ************************************************************************** This e-mail and any files transmitted with it may contain privileged or confidential information. It is solely for use by the individual for whom it is intended, even if addressed incorrectly. If you received this e-mail in error, please notify the sender; do not disclose, copy, distribute, or take any action in reliance on the contents of this information; and delete it from your system. Any other use of this e-mail is prohibited. Thank you for your compliance.