EVID 1100 : Event Logging Shutdown (Deutsch - Security)

Event Details

Event Type	Event Logging Shutdown
Event Description	1100(S) : The event logging service has shut down.
Event ID	1100

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>, <tag1>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
ErrorCode	N/A	<responsecode>
Publisher Id	N/A	<subject>
SubjectUserName	N/A	<subject>
Channel	N/A	N/A
Backup Path	N/A	<object>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1004686	EVID 1100 : Event Logging Shutdown	Base Rule	Process/Service Startup Or Shutdown Activity	Startup and Shutdown

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011090	V 2.0 : Event Logging Service Messages	Base Rule	General Logging Information	Information
	V 2.0 : EVID 1100 : Event Logging Service Shutdown	Sub Rule	Process/Service Stopped	Startup and Shutdown
	V 2.0 : EVID 1102 : Audit Log Cleared	Sub Rule	Log Cleared	Access Success
	V 2.0 : EVID 1104 : Security Log Full	Sub Rule	Log Full	Error
	V 2.0 : EVID 1105 : EventLog AutomaticallyBackedUp	Sub Rule	Backup Completed	Information
	V 2.0 : EVID 1108 : Error Encountered Proces Event	Sub Rule	General Event Log Error	Error