Share via

Common Output in Metabase Auditing Event Messages

  • Article

Applies To: Windows Server 2003 with SP1

All event messages produced when metabase auditing is enabled provide information specific to the event with content that is common to every event message. For example, the specific event message for a metabase audit set data event differs from the specific event message provided for a metabase audit copy data event. The set data event message includes the common output and information about the change to a specific property ID and property name, the old value and new value. While the event log message for a copy data metabase auditing event provides the common output and the destination and the source path of the copy action.

The Event Viewer details pane provides the following information about the metabase auditing event:

  • Event type - Success or Failure

  • When the event occurred - Date and time

  • Source - IIS Metabase

  • Event ID - specific to the metabase auditing event

  • User - the user account

  • Computer - short name for the computer

The metabase auditing event log message common output appears in the event properties view. The following table describes the event information common to each metabase auditing event log message.

Message Output - Common

Log Output Name Description

Primary User Name

The name of the user account that tried to change the metabase file manually when this information is possible to obtain, or System when a local system account was used.

Primary User Domain

The user domain when that information is possible to obtain.

Primary Logon ID

The ID used to log on to and change the metabase, when this information is possible to obtain.

Caller PID

The process ID of the application pool.

Caller Image Path

The absolute path of the resource.

Result

The variable representing the result.

For information about using metabase auditing, see Metabase Auditing.

To view sample output for one metabase auditing event message, see Sample Metabase Auditing Event Log.

For information about enabling metabase auditing, see Auditing the Metabase.