Skip to content

EventLogReader.ParseLevel: Critical events (level 1) misclassified as Information #259

@Christophe-Rogiers

Description

@Christophe-Rogiers

Description

EventLogReader.cs lines 63–76 map Windows Event Log levels to EventLogLevel but omit level 1 (Critical). Critical events fall through to the default case and are classified as Information.

Code

public static EventLogLevel ParseLevel(byte level)
{
    switch (level)
    {
        case 2: return EventLogLevel.Error;
        case 3: return EventLogLevel.Warning;
        case 4: return EventLogLevel.Information;
        default: return EventLogLevel.Information;  // level 1 (Critical) lands here
    }
}

Windows Event Log Standard Levels

Byte Meaning Current Mapping Correct Mapping
1 Critical Information (wrong) Error
2 Error Error Error
3 Warning Warning Warning
4 Information Information Information

Impact

Critical system events (e.g., service crashes, unrecoverable failures) appear as "Information" in the Servy Manager UI, hiding their true severity from operators.

Suggested Fix

case 1: return EventLogLevel.Error;  // Critical → map to Error (closest match)
case 2: return EventLogLevel.Error;

Or add a Critical value to the EventLogLevel enum for full fidelity.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions