From d4c2b96b89daf0c49d8299d5053ab585f92d16f3 Mon Sep 17 00:00:00 2001
From: "Felipe \"Zimmerle\" Costa" <fcosta@trustwave.com>
Date: Fri, 23 May 2014 09:35:00 -0300
Subject: [PATCH] IIS: Changes event ID (Issue #676)

ModSecurityIIS was reporting events to Windows using ID 0
which seems cause an unexpected verbose message at the
event logger window as reported on #676, changing the ID
to 0x1, although will be nice to have separated events for
misconfiguration, warnings, etc...
---
 iis/mymodule.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/iis/mymodule.cpp b/iis/mymodule.cpp
index 726a1e08..04b1438c 100644
--- a/iis/mymodule.cpp
+++ b/iis/mymodule.cpp
@@ -1310,7 +1310,7 @@ BOOL CMyHttpModule::WriteEventViewerLog(LPCSTR szNotification, WORD category)
         // Write any strings to the Event Viewer and return.
         return ReportEvent(
             m_hEventLog,
-            category, 0, 0,
+            category, 0, 0x1,
             NULL, 1, 0, &szNotification, NULL );
     }
     return FALSE;