CeLog Event Format (Windows CE 5.0)
Every CeLog event in the log is preceded by a CEL_HEADER structure that describes the event. This header contains a length, an event identifier, and a flag indicating whether a time stamp follows the header.
The following list shows the elements included in the amount of space taken up in the log by an event.
- 4-byte CEL_HEADER structure, and the size of the data as indicated in CEL_HEADER
- 4-byte timestamp, if present
- 4 bytes of flag data, if present
- 0-3 bytes of fill space to pad up to the next DWORD boundary.
If the time stamp flag is set in the event header, then the next 4 bytes following the header contain a time stamp value. The size of the time stamp data is not included in the size value that is stored in the event header, so if the time stamp flag is set in the event header, then the event actually takes up 4 bytes more space in the log than the event header indicates. The time stamp must be interpreted based on the timer frequency indicated by the CELID_LOG_MARKER event.
Event flags also modify the event format. If the event identifier is equal to CELID_FLAGGED, then the header and time stamp (if present) are followed by a 2-byte value with the actual identifier of the event, and a 2-byte flag value. For example, if an application calls CeLogData with wID=CELID_RAW_ULONG, fFlagged=TRUE and wFlag=3, then the event identifier in the event header is CELID_FLAGGED, the event identifier following the time stamp is CELID_RAW_ULONG, and the flag value is 3. The size of the additional event identifier and flag are not included in the size value that is stored in the event header. So, if the event contains a flag, then the event actually takes up 4 bytes more space in the log than the event header indicates
The buffer of event data is stored after the header and, if present, the timestamp and flag data. The size of the buffer is equal to the size value stored in the event header.
All events must be stored on DWORD-aligned boundaries. Hence, the buffer of event data can be followed by up to 3 bytes of unused space that fills to the next 4-byte boundary. This fill space is not included in the size value that is stored in the event header. For more information, see Maintaining DWORD Alignment.
See Also
Implementing an Event Tracking Library | Maintaining DWORD Alignment
Send Feedback on this topic to the authors