The WPC event system logs a series of events to the WPC crimson channel. The channel contents is viewable inside the log viewer and it has a path of: Microsoft-Windows-ParentalControls/Operational. The events are logged with a variety of different parameters, mostly you can see what they are from inside the event viewer itself. Of the logs in the system, the ones that are logged by default are SettingChangeEvent (logged by the WPC system), Game Start Event (logged by the gameux system), Url Visit Event (logged by the WPC system), Media Playback Event (logged by Media Player), File Download Event (logged by IE), AppOverrideEvent (logged by the WPC system), WebOverrideEvent (logged by the WPC system) and AppBlockedEvent (safer events copied from the insecure application log).
The logs are mostly as you would expect, the web and app override events are generated by the over the shoulder allowing of specific web sites, when it pops up the elevation dialog box and allows you to allow or block the url/app on the spot. The other events in the wpc log are not currently logged by any existing application and will require logging from the apps themselves. This log format is not going to change in the future though, so logging these events will mean they will show up in the next versions of WPC as well.
The following code is a series of constants that allow you to reference the various parts of the crimson logs easily. The enum WPCEvents is used to look at the eventid of the crimson log to see which of the wpc events it is referring to. The other enums are used to index into the user array of events when querying the crimson logs, to get the correct values out.
The enum of WPC_MEDIA_TYPE and WPC_MEDIA_EXPLICIT_TYPE are used when looking at the values for the MEDIATYPE and the EXPLICIT fields in the the media playback event.
The enum of WPCFLAG_IM_FEATURE is used to determine which features the IMFEATUREEVENT refers to. The feature event is logged for several different types of log events and this mask determines which type they are. It is legal for this mask to contain multiple flags to mark that this event is for multiple event types.
The enum of WPCSettings is used to look at the SETTING name inside the SETTINGSCHANGEVENT to figure out which of the settings is being changed. This is a number to make the setting localizable correctly.