title: ReportEvent limits
body: <p>I am trying to write a detailed error message to the system log using the <code>ReportEventW</code> function. Unfortunately, I am encountering problems which are apparently related to the limits within the function but I can't find any real documentation of them: there is a documented limit on <code>dwDataSize</code> and another limit on the maximum length of each string. I am not violating any of these limits, but I am still receiving a FALSE and GetLastError reports RPC_S_INVALID_BOUND.</p>
  
  <p>Through testing, I found that for my test case the limit is caused by the number of strings (<code>wNumStrings</code>), with 203 being the most I can put through correctly (additionally, for 204-206 strings the <code>ReportEventW</code> will return a TRUE but <strong>will not write to the log!</strong>). If I add 1024 dummy characters to the first line, I once again get an error and have to decrease the number of lines, as far as I can tell, by the same number of characters I added earlier, which would indicate that some total character limit on the whole message is coming to play. Unfortunately, I can't match it against any documented limit even if I ignore what the limits should apply to - my value of about 33300 characters is close to the value 31839 characters (max. length of each string), but sufficiently higher than that to make me discard the theory that the limit on a length of individual string also applies to the total length of the whole message. Apparently, if I add extra raw data, the limit goes down again, which suggests a limitation on the size of the whole event log record.</p>
  
  <p>My questions are:</p>
  
  <p>1) Does anyone know the actual limits for writing to the event log?</p>
  
  <p>2) Do these limits change with the different operating systems? All my tests were performed on Win10 x64, but I have a nasty suspicion that with different OSes, I will encounter a different limitation.</p>
  
  <p>3) Is this documented somewhere?</p>
  
  <p>Thanks.</p>
  
  <p><strong>Actual code (added on request)</strong></p>
  
  <pre><code>procedure WriteToEventLog(const Messages: array of string; const RawData: AnsiString);
  const
    MaxStringCount = High(Word); // je to WORD! Realne se limit zda byt mnohem mensi
    MaxRawDataLen = 61440;
    EmptyMessage = #0#0#0#0;
  type
    TPCharArray = array[0..65535] of PChar;
  var
    Handle: THandle;
    Msgs: ^TPCharArray;
    MsgCount: integer;
    DataPtr: PAnsiChar;
    DataLen: integer;
    i: Integer;
  begin
    MsgCount := Length(Messages);
    if MsgCount &gt; MaxStringCount then
      MsgCount := MaxStringCount;
    Msgs := AllocMem(MsgCount * Sizeof(PChar));
    try
      for i := 0 to Pred(MsgCount) do
      begin
        if Messages[i] = ''
          then Msgs[i] := EmptyMessage
          else Msgs[i] := PChar(Messages[i]);
      end;
      if RawData = '' then
      begin
        DataPtr := nil;
        DataLen := 0;
      end
      else
      begin
        DataPtr := @RawData[1];
        DataLen := Length(RawData);
        if DataLen &gt; MaxRawDataLen then
          DataLen := MaxRawDataLen;
      end;
      Handle := RegisterEventSource(nil, PChar(ParamStr(0)));
      if Handle &lt;&gt; 0 then
      begin
        try
          ReportEvent(Handle, EVENTLOG_ERROR_TYPE, 0, 0, nil, MsgCount, DataLen, Msgs, DataPtr);
        finally
          DeregisterEventSource(Handle);
        end;
      end;
    finally
      FreeMem(Msgs);
    end;
  end;
  </code></pre>
  
  <p>It is called with <code>Messages</code> array containing rows from an EurekaLog report (one row per message, about 300 rows).</p>