In Windows, Event Viewer incorrectly displays IPv6 addresses in event descriptions

In Windows, Event Viewer incorrectly displays IPv6 addresses in event descriptions

Article ID : 934640
Last Review : April 17, 2007
Revision : 1.1

SYMPTOMS

In Windows, when you use Event Viewer to view an event log that contains Microsoft Internet Protocol version 6 (IPv6) addresses, the IPv6 addresses do not display correctly in the descriptions of events. For example, an element of the event log payload replaces the scope ID part of the IPv6 address. In some cases, the multiple replacements are repeated several times in the IPv6 address.

Back to the top

CAUSE

This problem occurs when the IPv6 address contains a scope ID. A scope ID is represented by a percent sign (%) that is followed by a number.

In the following example, the IPv6 address contains a scope ID of 1:

1234:5678:90123:4567:8901:2345%1

Such an address will not display correctly in Event Viewer.

The event descriptions are formed by using a template and by using replacement values from the event payload. You do this by replacing any percent sign that is followed by a number with the appropriate event parameter.

In the 1234:5678:90123:4567:8901:2345%1 example, %1 will be replaced with the first parameter from the event payload. This replacement may be repeated multiple times. The number of times this replacement is repeated depends on the version of the operating system. Multiple replacements will occur if the parameter number that contains the IPv6 address matches the scope ID.

Note You cannot use an escape character to replace the percent sign in the IPv6 address.

Back to the top

WORKAROUND

To work around this issue when you publish a series of events into an event log, use one of the following methods:

• Preprocess the IPv6 parameters to make sure that the scope ID is removed. For example, use the following IPv6 address format:

1234:5678:90123:4567:8901:2345
• Preprocess the IPv6 parameters to make sure that a character, such as space, is inserted between the percent sign and the numeric scope ID. For example, use the following IPv6 address format:

1234:5678:90123:4567:8901:2345% 1

Other workarounds including the following methods:

• Remove the parameter that contains IPv6 address from the event description.
• Add the parameter to the binary data that is associated with the event.

Back to the top


APPLIES TO
• Windows Vista Ultimate
• Windows Vista Home Premium
• Windows Vista Business
• Windows Vista Enterprise
• Windows Vista Home Basic
• Microsoft Windows XP Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Media Center Edition
• Microsoft Windows XP Tablet PC Edition
• Microsoft Windows Millennium Edition

Back to the top

Keywords: 
kbtshoot kbeventlog kbprb kbexpertiseinter KB934640

Back to the top

 

Microsoft Knowledge Base Article

This article contents is Microsoft Copyrighted material.
Microsoft Corporation. All rights reserved. Terms of Use | Trademarks


You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

AddThis Social Bookmark Button

Leave a Reply

*
To prove that you're not a bot, enter this code
Anti-Spam Image