A previous debugging hole I fell into once accidentally and barely managed to escape left me with the impression that every event has a "custom" decoder associated; there's no "built-in" event types from the Event Viewer's perspective. There are a handful of very common "custom decoders" that when they break it is an interesting world of madness. In the case of my debugging, one of the decoders installed by the .NET Framework (and used by almost all apps that use the main .NET Event Log libraries) broke and needed repair. It seems like there is a bunch of power in building custom decoders, but I never want to try debugging one again.