Breadcrumbs

V 2.0 : EVID 16: General Log Message

Vendor Documentation

https://docs.us.sios.com/dkce/8.7.1/en/topic/dkce-driver-extmirr-system-event-log-messages


https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled


https://kb.eventtracker.com/evtpass/evtpages/EventId_16_Microsoft-Windows-Kerberos-Key-Distribution-Center_64863.asp#:~:text=This%20event%20is%20logged%20when,for%20generating%20a%20Kerberos%20ticket.&text=To%20resolve%20this%20issue%2C%20you,that%20has%20corrupt%20Kerberos%20keys

.

https://windows-event-explorer.app.elstc.co/publisher/Microsoft-Windows-Kernel-General/event/16/v0


https://windows-event-explorer.app.elstc.co/publisher/Microsoft-Windows-WindowsUpdateClient/event/16/v0


https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/automatic-updates-cannot-download-updates-event-16


https://www.ibm.com/support/pages/mpio-errors-and-reservation-conflicts-logged-when-attempts-are-made-move-cluster-resources-windows-2012-sdddsm-2433-5

Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0 : EVID 16: General Log Message

Base Rule

General Information Log Message

Information

V 2.0 : EVID 16: ExtMirr: Mirrored State Changed

Sub Rule

Mirror State Changed

Information

V 2.0 : EVID 16: Kerberos Ticket Not Generated

Sub Rule

General Kerberos Error

Error

V 2.0 : EVID 16: Access History Cleared

Sub Rule

Log Cleared

Access Success

V 2.0 : EVID 16: WindowsUpdateClient

Sub Rule

Connection Information

Information

V 2.0 : EVID 16: Mpio: MPIO Error

Sub Rule

General Error Log Message

Error

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

<tag2>

Text/String

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID Qualifiers

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

N/A

Level

<severity>

Text/String

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

N/A

N/A

N/A

Data

<object>

Text/String

N/A

Data

N/A

N/A

N/A

Data

N/A

N/A

N/A

Data

N/A

N/A

N/A

Data

N/A

N/A

N/A

Data

<dip>

IP Address

N/A

Binary

N/A

N/A

N/A

Target

<dname>
<domainimpacted>

Text/String

N/A

Account

N/A

N/A

N/A

ID

N/A

N/A

N/A

RequestedEtypes

N/A

N/A

N/A

AvailableEtypes

N/A

N/A

N/A

AccountToReset

<account>

Text/String

N/A

HiveNameLength

<size>

Number

N/A

HiveName

<object>

Text/String

N/A

KeysUpdated

N/A

N/A

N/A

DirtyPages

<quantity>

Number

N/A