File tree Expand file tree Collapse file tree 2 files changed +17
-5
lines changed
EventLogExpert.Eventing.Tests/EventResolvers
EventLogExpert.Eventing/Helpers Expand file tree Collapse file tree 2 files changed +17
-5
lines changed Original file line number Diff line number Diff line change @@ -1624,13 +1624,15 @@ public void ResolveEvent_WithSeverityLevel_ShouldResolveLevelString()
16241624 // Arrange
16251625 var resolver = new TestEventResolver ( ) ;
16261626
1627+ // ETW level 0 is "LogAlways" but Windows Event Viewer renders it as "Information"
16271628 var testCases = new [ ]
16281629 {
16291630 ( Level : ( byte ) 0 , Expected : "Information" ) ,
1631+ ( Level : ( byte ) 1 , Expected : "Critical" ) ,
16301632 ( Level : ( byte ) 2 , Expected : "Error" ) ,
16311633 ( Level : ( byte ) 3 , Expected : "Warning" ) ,
16321634 ( Level : ( byte ) 4 , Expected : "Information" ) ,
1633- ( Level : ( byte ) 5 , Expected : "5 " )
1635+ ( Level : ( byte ) 5 , Expected : "Verbose " )
16341636 } ;
16351637
16361638 foreach ( var testCase in testCases )
Original file line number Diff line number Diff line change 33
44namespace EventLogExpert . Eventing . Helpers ;
55
6+ /// <summary>Severity levels with values matching ETW standard levels (1–5).</summary>
67public enum SeverityLevel
78{
8- Information ,
9- Warning ,
10- Error
9+ Critical = 1 ,
10+ Error = 2 ,
11+ Warning = 3 ,
12+ Information = 4 ,
13+ Verbose = 5
1114}
1215
1316public static class Severity
1417{
18+ /// <summary>Maps an ETW level byte to its display string.</summary>
19+ /// <remarks>
20+ /// ETW level 0 is technically "LogAlways", but the Windows Event Viewer MMC and
21+ /// wevtutil both render it as "Information". We match that behavior intentionally.
22+ /// </remarks>
1523 public static string GetString ( byte ? level ) => level switch
1624 {
17- 0 => nameof ( SeverityLevel . Information ) ,
25+ 0 => nameof ( SeverityLevel . Information ) , // LogAlways — rendered as Information by Windows
26+ 1 => nameof ( SeverityLevel . Critical ) ,
1827 2 => nameof ( SeverityLevel . Error ) ,
1928 3 => nameof ( SeverityLevel . Warning ) ,
2029 4 => nameof ( SeverityLevel . Information ) ,
30+ 5 => nameof ( SeverityLevel . Verbose ) ,
2131 _ => level ? . ToString ( ) ?? string . Empty
2232 } ;
2333}
You can’t perform that action at this time.
0 commit comments