Messages are communicated to the message server through the IPC buffer. The IPC buffer is implemented in shared memory via a memory mapped file. This is chiefly for performance (inasmuch as memcpy pretty much stomps on whatever IPC option number two is) and to further that performance advantage we have an extremely high speed, custom designed, allocation biased memory manager that works on said shared memory. When a log message is created, the logging call uses that memory manager to allocate space for the incoming message, then copies the message elements, encrypts them, checksums them, and finally notifies the message server of the newly pending message.
Any application can initialize the IPC buffer first and any application can close it last. When it is closed, it is simply written to disk where it persists until an application logs a message or the message server starts up again at next reboot and picks up where it left off; whichever comes first. This implies that the message server does not need to be running when a message is logged. In fact, logging can go on for many days and many reboots without even starting the server and not miss a message provided the IPC buffer is not overflowed with the cumulative log messages. This is critical for applications like device drivers and other NT services that may be started and logging before the server comes up or still running and logging after the server shuts down. It is also critical for say a low level system driver that logs for a second and then kills everything within a ten foot radius so that the server cannot start and the machine must be rebooted. Memory mapped files are pretty central to the operating system and odds are that the IPC buffer will be saved. So someday when the driver gets fixed or told not to start and the machine can be minimally booted successfully the message server will then be able to retrieve those messages.
Size and location of the IPC buffer are configurable through the server configuration feature of the viewer. More details are available in the Configuration Settings appendix. See also the related notification message 420 regarding buffer size margins.