string_event_header
struct string_event_header s;
struct string_event_header *evh = (struct string_event_header *)buf;