The EventLogEntry.InstanceId property uniquely identifies an event entry for a configured event source. The EventLogEntry.InstanceId for an event log entry represents the full 32-bit resource identifier for the event in the message resource file for the event source. The EventLogEntry.EventID property equals the EventLogEntry.InstanceId with the top two bits masked off. Two event log entries from the same source can have matching EventLogEntry.EventID values, but have different EventLogEntry.InstanceId values due to differences in the top two bits of the resource identifier.

If the application wrote the event entry using one of the erload:System.Diagnostics.EventLog.WriteEntry methods, the EventLogEntry.InstanceId property matches the optional eventId parameter. If the application wrote the event using erload:System.Diagnostics.EventLog.WriteEvent, the EventLogEntry.InstanceId property matches the resource identifier specified in the EventInstance.InstanceId of the instance parameter. If the application wrote the event using the Win32 API ReportEvent, the EventLogEntry.InstanceId property matches the resource identifier specified in the dwEventID parameter.

For details about defining event messages and building event log resource files, see the "Message Compiler" topic in the Platform SDK documentation at tp://msdn.microsoft.com/. For details about event log identifiers, see the "Event Identifiers" topic in the Platform SDK.