V 2.0 : EVID 1: General Log Message

V 2.0 : EVID 1: General Log Message

Base Rule

General Information Log Message

Information

V 2.0 : EVID 1: Cbafilt:Cba FS Filter Driver Event

Sub Rule

General Information Log Message

Information

V 2.0 : EVID 1: ExtMirr:Driver Started Successfully

Sub Rule

Process/Service Started

Startup and Shutdown

V 2.0 : EVID 1: IScsiPrt : Connection Error

Sub Rule

Connection Error

Error

V 2.0 : EVID 1: MEI: Interface Reset Event

Sub Rule

General Warning Log Message

Warning

V 2.0 : EVID 1: MEIx64: Interface Reset Event

Sub Rule

General Warning Log Message

Warning

V 2.0 : EVID 1: Filter Manager FS Filter Unloaded

Sub Rule

General Information Log Message

Information

V 2.0 : EVID 1: Hyper-V-Hypervisor: Hypervisor Suc

Sub Rule

Service Started

Information

V 2.0 : EVID 1: Hyper-V-Netvsc: Protocol Ver Succ

Sub Rule

Successful Activity

Other Audit Success

V 2.0 : EVID 1: Kernel-General:System Time Changed

Sub Rule

System Time Updated

Information

V 2.0 : EVID 1: Kernel-Tm:Transaction Unable To Com

Sub Rule

Commit Transaction Failure

Error

V 2.0 : EVID 1: Mpio: Object Created

Sub Rule

Object Created

Access Success

Provider

<tag2>

Text/String

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID/EventID Qualifiers

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

N/A

Level

<severity>

Text/String

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

N/A

N/A

N/A

ErrorCode

<responsecode>

Number

N/A

DataItemName

N/A

N/A

N/A

EventPayload

N/A

N/A

N/A

NewTime

N/A

N/A

N/A

OldTime

N/A

N/A

N/A

VersionLen

<size>

Number

N/A

Version

<version>

Number/Text/String

N/A

Status

<status>

Number

N/A

FinalStatus

<status>

Text/String

N/A

DeviceVersionMajor

<version>

Number

N/A

DeviceVersionMinor

N/A

N/A

N/A

DeviceNameLength

N/A

N/A

N/A

DeviceName

<object>

Text/String

N/A

DeviceTime

N/A

N/A

N/A

Data

N/A

N/A

N/A

Data

<object>

Text/String

N/A

Binary

N/A

N/A

N/A

RenderingInfo

N/A

N/A

N/A

Message

<subject>

Text/String

N/A