Errors and Warnings Events Data Columns
The Security Audit event category has the following event class:
- Error class
The following table lists the data columns for this event class.
Error Event Class—Data Columns
| Column Name | Column Id | Column Type | Column Description |
|---|---|---|---|
| EventClass | 0 | 1 | Event Class is used to categorize events. |
| StartTime | 3 | 5 | Contains the time at which the event started, when available. For filtering, expected formats are 'YYYY-MM-DD' and 'YYYY-MM-DD HH:MM:SS'. |
| SessionType | 8 | 8 | Contains the type of the entity that caused the error. |
| Severity | 22 | 1 | Contains the severity level of an exception associated with the error event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error |
| Success | 23 | 1 | Contains the success or failure of the error event. Values are: 0 = Failure 1 = Success |
| Error | 24 | 1 | Contains the error number of any error associated with the error event. |
| ConnectionID | 25 | 1 | Contains the unique connection ID associated with the error event. |
| DatabaseName | 28 | 8 | Contains the name of the Analysis Services instance on which the error event occurred. |
| NTUserName | 32 | 8 | Contains the user name associated with the command event. Depending on the environment, the user name is in the following form: - Windows user account (DOMAIN\UserName) - User Principal Name (UPN) (username@domain.com) - Service Principal Name (SPN) (appid@tenantid) - Power BI Service Account (Power BI Service) - Power BI Service on behalf of a UPN or SPN (Power BI Service (UPN/SPN)) |
| NTDomainName | 33 | 8 | Contains the domain name associated with the user account that triggered the command event. - Windows domain name for Windows user accounts - AzureAD for Microsoft Entra accounts - NT AUTHORITY accounts without a Windows domain name, such as the Power BI service |
| ClientHostName | 35 | 8 | Contains the name of the computer on which the client is running. This data column is populated if the host name is provided by the client. |
| ClientProcessID | 36 | 1 | Contains the process ID of the client application. |
| ApplicationName | 37 | 8 | Contains the name of the client application that created the connection to the server. This column is populated with the values passed by the application rather than the displayed name of the program. |
| SessionID | 39 | 8 | Contains the server process ID (SPID) that uniquely identifies the user session associated with the error event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA). |
| SPID | 41 | 1 | Contains the server process ID (SPID) that uniquely identifies the user session associated with the error event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA). |
| TextData | 42 | 9 | Contains the text data associated with the error event. |
| ServerName | 43 | 8 | Contains the name of the server running Analysis Services instance on which the error event occurred. |