In Windows, Event Viewer incorrectly displays IPv6 addresses in event descriptions

In Windows, when you use Event Viewer to view an event log that contains Microsoft Internet Protocol version 6 (IPv6) addresses, the IPv6 addresses do not display correctly in the descriptions of events. For example, an element of the event log payload replaces the scope ID part of the IPv6 address. In some cases, the multiple replacements are repeated several times in the IPv6 address.

This problem occurs when the IPv6 address contains a scope ID. A scope ID is represented by a percent sign (%) that is followed by a number.

In the following example, the IPv6 address contains a scope ID of 1: Such an address will not display correctly in Event Viewer.

The event descriptions are formed by using a template and by using replacement values from the event payload. You do this by replacing any percent sign that is followed by a number with the appropriate event parameter.

In the 1234:5678:90123:4567:8901:2345%1 example, %1 will be replaced with the first parameter from the event payload. This replacement may be repeated multiple times. The number of times this replacement is repeated depends on the version of the operating system. Multiple replacements will occur if the parameter number that contains the IPv6 address matches the scope ID.

Note You cannot use an escape character to replace the percent sign in the IPv6 address.

To work around this issue when you publish a series of events into an event log, use one of the following methods:

• Preprocess the IPv6 parameters to make sure that the scope ID is removed. For example, use the following IPv6 address format:
  1234:5678:90123:4567:8901:2345
• Preprocess the IPv6 parameters to make sure that a character, such as space, is inserted between the percent sign and the numeric scope ID. For example, use the following IPv6 address format:
  1234:5678:90123:4567:8901:2345% 1

Other workarounds including the following methods:

• Remove the parameter that contains IPv6 address from the event description.
• Add the parameter to the binary data that is associated with the event.