V 2.0 : Catch-All

V 2.0: Catch-All

Base Rule

General Information Log Message

Information

V 2.0: EVID 1: NCR_LKF

Sub Rule

General System Event

Information

V 2.0: EVID 1: Tbimdsa

Sub Rule

General System Event

Information

V 2.0: EVID 4: B57nd60a

Sub Rule

General System Event

Information

V 2.0: EVID 5: Hyper-V-VmSwitch

Sub Rule

General System Event

Information

V 2.0: EVID 6: EPSON_PCS_Parallel_Port_Driver

Sub Rule

General System Event

Information

V 2.0: EVID 7: Hyper-V-VmSwitch

Sub Rule

General System Event

Information

V 2.0: EVID 9: Hyper-V-VmSwitch

Sub Rule

General System Event

Information

V 2.0: EVID 15: B57nd60a

Sub Rule

General System Event

Information

V 2.0: EVID 27: E1cexpress

Sub Rule

General System Event

Information

V 2.0: EVID 33: E1cexpress

Sub Rule

General System Event

Information

V 2.0: EVID 33: E1kexpress

Sub Rule

General System Event

Information

V 2.0: EVID 34: E1cexpress

Sub Rule

General System Event

Information

V 2.0: EVID 46: Mpio

Sub Rule

General System Event

Information

V 2.0: EVID 4342: Wins

Sub Rule

General System Event

Information

V 2.0: EVID 5060: NETwNs32

Sub Rule

General System Event

Information

V 2.0: EVID 7003: Netwtw06

Sub Rule

General System Event

Information

V 2.0: EVID 8000: NETwNs32

Sub Rule

General System Event

Information

V 2.0: EVID 8225: CMGShieldReg

Sub Rule

General System Event

Information

Provider

<tag2>

Text/String

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID 

<vmid>

<tag1>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

N/A

Level

N/A

N/A

The severity level is defined in the event.

Task

N/A

N/A

The task is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

N/A

N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

N/A

N/A

The name of the computer on which the event occurred.

Security

N/A

N/A

N/A

Data

N/A

N/A

N/A

Binary

N/A

N/A

N/A