Skip to main content
Skip table of contents

LSO: MS Windows Event Logging XML - System (Mapping Doc)

This document explains the changes required to apply new Message Processing Engine (MPE) rules developed during the Log Source Optimization (LSO) project for the MS Windows Event Logging XML - System log source type. 


Supported Log Messages

The following table lists the log message types supported in the current MPE rules. Each page contains detailed information on parsing changes and new log processing settings.

Log Message TypeEvent Type
Catch All : Level 2General Information
Connection Status EventsConnection Information
DHCP Scope Full/Nearly FullDHCP Potentially Serious Problem
Disk MessagesGeneral Disk Information
EVID 1 & 6 : Filter Driver Load/UnloadProcess/Service Startup Or Shutdown Activity
EVID 1 : System Time ChangedSystem Time Updated
EVID 11 : KDC Duplicate NameGeneral Kerberos Error
EVID 28 : Kerberos Unsuitable Key VerificationGeneral Kerberos Warning
EVID 35 & 37 : Time SychronizationGeneral NTP Information
EVID 56 : Client Disconnected - Protocol ErrorDisconnect Session
EVID 98 : Offline Chkdsk Needed For VolumeGeneral Information
EVID 104 : Log ClearedLog Cleared
EVID 109 : Kernel Power Initiated ShutdownSystem Shutting Down
EVID 137 : Transact. Resource Mgr Error On VolumeGeneral Disk Error
EVID 156 : ExtMirr Unable To Get File System InfoGeneral Disk Warning
EVID 219 : Driver Failed To LoadDriver Failed To Load
EVID 220 : Resync Of VolumeSynchronization Started
EVID 1001 : Bugcheck RebootUnclean Shutdown
EVID 1014 : Name Resolution Timed OutTimeout
EVID 1030 : Failed Processing Of Group PolicyWindows Group Policy Problem
EVID 1044 : DHCP/BINL Service Authorized To StartProcess/Service Started
EVID 1063 : No IPs Available For Lease In ScopeDHCP Lease Cannot Be Obtained
EVID 1067 : Cannot Register SPNRegistration Failure
EVID 1074 & 1076 : Restart/Shutdown EventsProcess/Service Startup Or Shutdown Activity
EVID 1085 : Group Policy Extension FailureWindows Group Policy Problem
EVID 1111 : Term Services : Unknown Printer DriverPrinter Not Ready
EVID 1151 & 1152 : Dell Server Voltage Sensor InfoPower Info Msg
EVID 1340 : DNS Registration Failed For ClientGeneral DNS Warning
EVID 1342 : Scope Out Of IPsDHCP Address Pool Exhausted
EVID 1376 : DHCP Scope Nearly ExhaustedGeneral DHCPServer Warning
EVID 4105 : Cannot Update License AttributesLicense Warning
EVID 5719 : Logon Domain ControllerMS Windows Domain Controller Allow Serve
EVID 5722 & 5723 : NETLOGON Authentication FailureComputer Logon Failure
EVID 5805 : Session Setup Failed To AuthenticateAuthentication Failure Activity
EVID 5807 : Connections From Unmapped IP AddressesUnable To Verify Connections
EVID 5823 : System Password Changed On DCAuthentication Activity
EVID 5840: NETLOGON: Netlogon ServiceChannel Status
EVID 7000 : Service Failed To StartFailed Service Start
EVID 7001-7002 : CEIP NotificationAuthentication Activity
EVID 7001-7003 : Service Start ErrorsFailed Service Start
EVID 7009 & 7011 : Service TimeoutGeneral Service Control Manager Information
EVID 7032 : Service Recovery FailedProcess/Service Stopped
EVID 7034 : Service Terminated UnexpectedlyProcess/Service Stopped
EVID 7036 : Service StatusProcess/Service Startup Or Shutdown Activity
EVID 7038 : Service Unable To LogonService Start Failure
EVID 7040 : Service Start Type ChangedProcess/Service Startup Or Shutdown Activity
EVID 7042 : Service Stopped SuccessfullyProcess/Service Stopped
EVID 7045: Service InstalledSoftware Installed
EVID 8018 : Failed To Register Host RecordsGeneral DNS Warning
EVID 10009 : DCOM Unable To Communicate With CompCommunication Failure
EVID 10016 : DCOM Access DeniedAccess Denied
EVID 10028 : DCOM Unable To Communicate With CompCommunication Failure
EVID 10154 : WinRM - SPN Creation FailureFailed Configuration
EVID 12294 : SAM Lockout Failed : ResourcesLock User Request Failed
EVID 14554 :Shared Folder Initialization By DfsSvcGeneral DfsSvc Information
EVID 20250: User ConnectedSession Connected
EVID 20271 And 20255 : Connection PreventedAuthentication Method Not Supported
EVID 20272: User DisconnectedSession Disconnected
EVID 20274: IP Address Assigned To UserIP Address Assigned
EVID 20275: User DisconnectedSession Disconnected
EVID 36867 : Creating SSL CredentialObject Created
EVID 36880 : Handshake Completed SuccessfullySSL Connection Created
EVID 45058 : Oldest Cached Logon Info RemovedGeneral Maintenance Information
EVID : 6013 System UptimeUptime
Group Policy MessagesPolicy Notification
Kerberos Key Integrity ErrorGeneral Kerberos Error
Kernel EVID 16 : Hive Access History ClearedObject Deleted/Removed
Machine Account Vulnerable NetLogon ConnectionsGeneral Threat Message
Microsoft Windows Bits Client MessagesGeneral BITS Information
Mirror State ChangeObject Modified
MPIO MessagesGeneral Disk Information
NTP Local And ManualGeneral NTP Message
NTP MessagesNTPD Information
NTP Time Synchronization OffsetNTPD Warning
Pattern 2 : General Error MessagesGeneral Operations
Pattern 3 : General Warning MessagesGeneral Operations
Pattern 4 : General Informational MessagesGeneral Operations
Pattern Catch All : Level 3General Information
RPM Session EventsSession Information
RPM Session EventsSession Information
Service ErrorProcess/Service Stopped
Service Terminated UnexpectedlyProcess/Service Stopped
Shadow Copy MessagesGeneral Volume Shadow Copy Svc Task Information
Storage Adapter MessagesISCSI Information
TCP/IP Network Interface ConfigurationNetwork Interface Changed State
Trust Account Vulnerable NetLogon ConnectionsGeneral Threat Message
Windows Update ClientUpdate Event

Log Processing Policy Updates

This section details log processing policy updates made to AIE Rules, system reports, system investigations, system report templates, and system tails as part of LSO.

Updates to AIE Rules

  • No changes

Updates to System Reports

  • No changes

Updates to System Investigations

  • No changes

Updates to System Report Templates

  • No changes

Updates to System Tails

  • No changes
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.