PNG  IHDR;IDATxܻn0K )(pA 7LeG{ §㻢|ذaÆ 6lذaÆ 6lذaÆ 6lom$^yذag5bÆ 6lذaÆ 6lذa{ 6lذaÆ `}HFkm,mӪôô! x|'ܢ˟;E:9&ᶒ}{v]n&6 h_tڠ͵-ҫZ;Z$.Pkž)!o>}leQfJTu іچ\X=8Rن4`Vwl>nG^is"ms$ui?wbs[m6K4O.4%/bC%t Mז -lG6mrz2s%9s@-k9=)kB5\+͂Zsٲ Rn~GRC wIcIn7jJhۛNCS|j08yiHKֶۛkɈ+;SzL/F*\Ԕ#"5m2[S=gnaPeғL lذaÆ 6l^ḵaÆ 6lذaÆ 6lذa; _ذaÆ 6lذaÆ 6lذaÆ RIENDB` im_mseventlog raw_event string FALSE A string containing the timestamp, hostname, severity, and message from the event. Message string FALSE FALSE The message from the event. EventTime datetime TRUE The TimeGenerated field of the EventRecord. EventTimeWritten datetime FALSE The TimeWritten field of the EventRecord. Hostname string TRUE TRUE The host or computer name field of the EventRecord. SourceName string TRUE The event source which produced the event (the subsystem or application name). EventID integer TRUE The event ID of the EventRecord. CategoryNumber integer TRUE The category number, stored as Category in the EventRecord. Category string TRUE The category name resolved from CategoryNumber. FileName string TRUE TRUE The logfile source of the event (for example, `Security` or `Application`). AccountName string TRUE TRUE The username associated with the event. AccountType string TRUE TRUE The type of the account. Possible values are: `User`, `Group`, `Domain`, `Alias`, `Well Known Group`, `Deleted Account`, `Invalid`, `Unknown`, and `Computer`. Domain string TRUE TRUE The domain name of the user. SeverityValue integer TRUE The normalized severity number of the event, mapped as follows. [cols="2", options="header,autowidth"] |=== |Event Log Severity |Normalized Severity |0/Audit Success |2/INFO |0/Audit Failure |4/ERROR |1/Critical |5/CRITICAL |2/Error |4/ERROR |3/Warning |3/WARNING |4/Information |2/INFO |5/Verbose |1/DEBUG |=== Severity string TRUE The normalized severity name of the event. See <<im_mseventlog_field_SeverityValue,$SeverityValue>>. EventType string TRUE TRUE The type of the event, which is a string describing the severity. Possible values are: `ERROR`, `AUDIT_FAILURE`, `AUDIT_SUCCESS`, `INFO`, `WARNING`, and `UNKNOWN`. RecordNumber integer FALSE The number of the event record.