Event-Log Fields

The field names in the Windows 2000 and later event (.evt) logs are EventLog, RecordNumber, TimeGenerated, TimeWritten, EventID, EventType, EventTypeName, SourceName, EventCategory, Strings, Message, ComputerName, and SID. Let's examine how these fields come into play when you use LogParser to process events from the Security log.

EventLog contains the name of the event log in which the current row in the LogParser output table originated. EventLog is important only in situations in which you specify multiple logs in LogParser's FROM clause. RecordNumber specifies the number of an event record within the log. TimeGenerated and TimeWritten specify the date and time that the event was reported to the Event Logging service and the date and time that the service recorded the event in the log. (These two fields usually share the same value.)

EventID is an important field because it contains the event's Windows event ID. For example, Windows identifies account lockouts as event ID 644 and successful logons as event ID 528. (For a comprehensive discussion of Windows event IDs and their meanings, see "Mining the Win2K Security Log," April 2001, InstantDoc ID 20052; "Audit Account Logon Events," March 2001, InstantDoc ID 19677; and "Tracking Logon and Logoff Activity in Win2K," February 2001, InstantDoc ID 16430.) EventType and EventTypeName specify whether the event was a success or a failure. For example, event ID 529 (logon failure: bad username or password) shows an EventType of 16 and an EventTypeName of Failure Audit event, whereas event ID 528 (successful logon) shows an EventType of 8 and an EventTypeName of Success Audit event. (The Security log's EventType field can have a value of 8 or 16; the System and Application logs use other values to indicate information, warning, and error events.) . . .