File tree Expand file tree Collapse file tree 2 files changed +17
-5
lines changed
EventLogExpert.Eventing.Tests/EventResolvers
EventLogExpert.Eventing/Helpers Expand file tree Collapse file tree 2 files changed +17
-5
lines changed Original file line number Diff line number Diff line change @@ -1609,13 +1609,15 @@ public void ResolveEvent_WithSeverityLevel_ShouldResolveLevelString()
16091609 // Arrange
16101610 var resolver = new TestEventResolver ( ) ;
16111611
1612+ // ETW level 0 is "LogAlways" but Windows Event Viewer renders it as "Information"
16121613 var testCases = new [ ]
16131614 {
16141615 ( Level : ( byte ) 0 , Expected : "Information" ) ,
1616+ ( Level : ( byte ) 1 , Expected : "Critical" ) ,
16151617 ( Level : ( byte ) 2 , Expected : "Error" ) ,
16161618 ( Level : ( byte ) 3 , Expected : "Warning" ) ,
16171619 ( Level : ( byte ) 4 , Expected : "Information" ) ,
1618- ( Level : ( byte ) 5 , Expected : "5 " )
1620+ ( Level : ( byte ) 5 , Expected : "Verbose " )
16191621 } ;
16201622
16211623 foreach ( var testCase in testCases )
Original file line number Diff line number Diff line change 33
44namespace EventLogExpert . Eventing . Helpers ;
55
6+ /// <summary>Severity levels with values matching ETW standard levels (1–5).</summary>
67public enum SeverityLevel
78{
8- Information ,
9- Warning ,
10- Error
9+ Critical = 1 ,
10+ Error = 2 ,
11+ Warning = 3 ,
12+ Information = 4 ,
13+ Verbose = 5
1114}
1215
1316public static class Severity
1417{
18+ /// <summary>Maps an ETW level byte to its display string.</summary>
19+ /// <remarks>
20+ /// ETW level 0 is technically "LogAlways", but the Windows Event Viewer MMC and
21+ /// wevtutil both render it as "Information". We match that behavior intentionally.
22+ /// </remarks>
1523 public static string GetString ( byte ? level ) => level switch
1624 {
17- 0 => nameof ( SeverityLevel . Information ) ,
25+ 0 => nameof ( SeverityLevel . Information ) , // LogAlways — rendered as Information by Windows
26+ 1 => nameof ( SeverityLevel . Critical ) ,
1827 2 => nameof ( SeverityLevel . Error ) ,
1928 3 => nameof ( SeverityLevel . Warning ) ,
2029 4 => nameof ( SeverityLevel . Information ) ,
30+ 5 => nameof ( SeverityLevel . Verbose ) ,
2131 _ => level ? . ToString ( ) ?? string . Empty
2232 } ;
2333}
You can’t perform that action at this time.
0 commit comments