Hi Bobby,
what I am doing is that I copy HTTP_TRACE_EVENT parameter value received in ProcessLogEvent function of my module, then the copy is sent to a message queue.
Below is HTTP_TRACE_EVENT_ITEM filled with "Status" info, captured while I was debugging. (It's original parameter value, not a copy)

If it is 2 bytes signed int16, it gives me value of 48. I expect this to be either 404 or 304. (In fact, only status 200 seems to be valid among all data I captured.)
Except for message queue part, my module code is almost identical to the sample code found in Real-Time logging article in this site.
Isn't the "Status" item's value above look strange?