Why do events logged by the ReportEvent function show up in the wrong order in the Event Viewer?

A customer observed that when their service logs multiple events in rapid succession, they sometimes show up out of order in Event Viewer. Specifically, the order of events that all occur within the same second are sometimes mis-ordered relative to each other. Is this expected?

Events in the event viewer are timestamped only to one-second resolution. The EVENT­LOG­RECORD structure reports time in UNIX format, namely, seconds since January 1, 1970.

Experimentation suggested that the Event Viewer sorts events by timestamp, but it does not use a stable sort, so multiple events that occur within the same second end up in an unpredictable order.

Not much you can do about it, but at least now you know that you’re not hallucinating.