Event Log Forwarding Metrics

Last published : Oct 14, 2026
Related information
ESA Metrics

Event Log Forwarding Windows

uberAgent can collect Windows system logs from the Eventlog: Application, Security, etc, with advanced filtering capabilities aimed to reduce the data volume processed by the agent.

Details

  • Source type: uberAgentESA:System:WinEvtLogForwarding
  • Used in dashboards: Windows Eventlogs
  • Enabled through configuration setting: EventLog
  • Related configuration settings: Timer
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
ProviderName Eventlog provider name String Microsoft-Windows-Security-Auditing
EventID Event ID Number 1001
Level Event level Number 3
ProcessID Process ID Number 53646
Channel Eventlog channel name String Security
User User, under which the process is executing String NT AUTHORITY\SYSTEM
EventData The content of the <EventData>-tag in JSON format String {"SubjectUserSid":"S-1-5-18", "SubjectUserName":"SYSTEM", "SubjectDomainName":"NT AUTHORITY", "SubjectLogonId":"0x3e7", "PrivilegeList":"SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege" }

Event Log Forwarding macOS

uberAgent® is capable of collecting macOS system logs and utilizing predicates to filter out unnecessary messages. This approach conserves bandwidth and enhances performance, ensuring that critical events are prominently visible in the dashboard.

Details

  • Source type: uberAgentESA:System:MacOsSystemLogForwarding
  • Used in dashboards: macOS System Logs
  • Enabled through configuration setting: EventLog
  • Related configuration settings: Timer
  • Supported platform: macOS

List of Fields in the Raw Agent Data

Field Description Data type Example
LevelValue The integer value of the log level Number 2
Count Frequency of message occurrence Number 10
ProcessID The associated processes id Number 1368
ProcName The processes associated name String Safari
Message The log message String Failed to open service: 0xe00002d8: Caller lacks TCC authorization for Full Disk Access
LevelDescription The log level's text description String error
Subsystem The subsystem used for logging the message String com.apple.Accessibility
Category Classifies messages by their source or type String AXTTSResourceManager
AppId Represents the AppId associated with the process String Sfr