WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T18:28:10.333Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"1001","created":"2024-07-26T18:28:10.920Z","kind":"event","provider":"Directory Synchronization"},"host":{"name":"Nordc-APP-ADFS1.acme.com"},"log":{"level":"information"},"message":"Scheduler::SchedulerThreadMain : SQL LocalDB Model Database Recovery Model:\n SIMPLE\nDiagnostics:\n DBCC execution completed. If DBCC printed error messages, contact your system administrator.\n\nDBINFO STRUCTURE:\n\n\n\nDBINFO @0x000000262CEFBB10\n\n\ndbi_version = 904                   dbi_createVersion = 897             dbi_SEVersion = 0\n\ndbi_dvSplitPoint = 0:0:0 (0x00000000:00000000:0000)                      \n\ndbi_dbbackupLSN = 0:0:0 (0x00000000:00000000:0000)                       \n\ndbi_LastLogBackupTime = 1900-01-01 00:00:00.000                          \n\ndbi_nextseqnum = 1900-01-01 00:00:00.000                                 dbi_status = 0x40010008\n\ndbi_crdate = 1900-01-01 00:00:00.000dbi_dbname = model                  dbi_dbid = 3\n\ndbi_cmptlevel = 150                 dbi_masterfixups = 0                dbi_maxDbTimestamp = 2000\n\ndbi_dbbackupLSN = 0:0:0 (0x00000000:00000000:0000)                       dbi_RebuildLogs = 0\n\ndbi_differentialBaseLSN = 0:0:0 (0x00000000:00000000:0000)               dbi_RestoreFlags = 0x0000\n\ndbi_checkptLSN = 56:2416:1 (0x00000038:00000970:0001)                    dbi_dbccFlags = 2\n\ndbi_COWLastLSN = 0:0:0 (0x00000000:00000000:0000)                        \n\ndbi_DirtyPageLSN = 56:2416:1 (0x00000038:00000970:0001)                  dbi_RecoveryFlags = 0x00000000\n\ndbi_lastxact = 0x320                dbi_collation = 872468488           dbi_relstat = 0x41000000\n\ndbi_PartitionDbFlags = 0            dbi_familyGUID = 00000000-0000-0000-0000-000000000000\n\ndbi_maxLogSpaceUsed = 3493376       \ndbi_recoveryForkNameStack\n\n\n\nentry 0\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nm_guid = 90d16058-f1d1-4e96-8ec6-8d7bfda42f15                            \n\n\nentry 1\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nm_guid = 00000000-0000-0000-0000-000000000000                            \n\ndbi_differentialBaseGuid = 00000000-0000-0000-0000-000000000000          dbi_firstSysIndexes = 0001:00000014\n\ndbi_oldestBackupXactLSN = 0:0:0 (0x00000000:00000000:0000)               \n\ndbi_versionChangeLSN = 35:312:3 (0x00000023:00000138:0003)               dbi_mdUpgStat = 0x0004\n\ndbi_category = 0x0000000000000000   dbi_safetySequence = 0              \n\ndbi_dbMirrorId = 00000000-0000-0000-0000-000000000000                    \n\ndbi_pageUndoLsn = 0:0:0 (0x00000000:00000000:0000)                       dbi_pageUndoState = 0\n\ndbi_disabledSequence = 0            dbi_dbmRedoLsn = 0:0:0 (0x00000000:00000000:0000)\n\ndbi_dbmOldestXactLsn = 0:0:0 (0x00000000:00000000:0000)                  dbi_CloneCpuCount = 0\n\ndbi_CloneMemorySize = 0             dbi_updSysCatalog = 1900-01-01 00:00:00.000\n\ndbi_LogBackupChainOrigin = 0:0:0 (0x00000000:00000000:0000)              \n\ndbi_dbccLastKnownGood = 1900-01-01 00:00:00.000                          dbi_roleSequence = 0\n\ndbi_dbmHardenedLsn = 0:0:0 (0x00000000:00000000:0000)                    dbi_localState = 0\n\ndbi_safety = 0                      dbi_modDate = 1900-01-01 00:00:00.000\n\ndbi_verRDB = 251662378              dbi_delayedDurabilityOption = 0     \n\ndbi_acceleratedDatabaseRecoveryOption = 0                                dbi_stalePageDetectionOption = 0\n\ndbi_inMemorydbOption = 0            dbi_svcBrokerGUID = 00000000-0000-0000-0000-000000000000\n\ndbi_svcBrokerOptions = 0x00000000   dbi_dbmLogZeroOutstanding = 0       dbi_dbmLastGoodRoleSequence = 0\n\ndbi_dbmRedoQueue = 0                dbi_dbmRedoQueueType = 0            dbi_rmidRegistryValueDeleted = 0\n\ndbi_dbmConnectionTimeout = 0        dbi_AuIdNext = 1099511627953        \n\ndbi_MinSkipLsn = 0:0:0 (0x00000000:00000000:0000)                        dbi_commitTsOfcheckptLSN = 0\n\ndbi_dbEmptyVersionState = 0         dbi_CurrentGeneration = 0           \ndbi_EncryptionHistory\n\n\n\nScan 0\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\n\nScan 1\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\n\nScan 2\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\ndbi_latestVersioningUpgradeLSN = 18:65:69 (0x00000012:00000041:0045)     \n\ndbi_PendingRestoreOutcomesId = 00000000-0000-0000-0000-000000000000      dbi_ContainmentState = 0\n\ndbi_hkRecoveryLSN = 0:0:0 (0x00000000:00000000:0000)                     \n\ndbi_hkLogTruncationLSN = 0:0:0 (0x00000000:00000000:0000)                dbi_hkCompatibilityMode = 0\n\ndbi_hkRootFile = 00000000-0000-0000-0000-000000000000                    dbi_hkRootFileWatermark = 0\n\ndbi_hkTrimLSN = 0:0:0 (0x00000000:00000000:0000)                         \n\ndbi_hkUpgradeLSN = 0:0:0 (0x00000000:00000000:0000)                      \n\ndbi_hkUndeployLSN = 0:0:0 (0x00000000:00000000:0000)                     dbi_databaseMaxSizeBytes = 0\n\ndbi_pvsRowsetIdRegular = 72057594042908672                               \n\ndbi_pvsRowsetIdLongTerm = 72057594042974208                              \n\nDBCC execution completed. If DBCC printed error messages, contact your system administrator.","organization":"acme","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"Nordc-APP-ADFS1.acme.com","event_data":{"param1":"Scheduler::SchedulerThreadMain : SQL LocalDB Model Database Recovery Model:\n SIMPLE\nDiagnostics:\n DBCC execution completed. If DBCC printed error messages, contact your system administrator.\n\nDBINFO STRUCTURE:\n\n\n\nDBINFO @0x000000262CEFBB10\n\n\ndbi_version = 904                   dbi_createVersion = 897             dbi_SEVersion = 0\n\ndbi_dvSplitPoint = 0:0:0 (0x00000000:00000000:0000)                      \n\ndbi_dbbackupLSN = 0:0:0 (0x00000000:00000000:0000)                       \n\ndbi_LastLogBackupTime = 1900-01-01 00:00:00.000                          \n\ndbi_nextseqnum = 1900-01-01 00:00:00.000                                 dbi_status = 0x40010008\n\ndbi_crdate = 1900-01-01 00:00:00.000dbi_dbname = model                  dbi_dbid = 3\n\ndbi_cmptlevel = 150                 dbi_masterfixups = 0                dbi_maxDbTimestamp = 2000\n\ndbi_dbbackupLSN = 0:0:0 (0x00000000:00000000:0000)                       dbi_RebuildLogs = 0\n\ndbi_differentialBaseLSN = 0:0:0 (0x00000000:00000000:0000)               dbi_RestoreFlags = 0x0000\n\ndbi_checkptLSN = 56:2416:1 (0x00000038:00000970:0001)                    dbi_dbccFlags = 2\n\ndbi_COWLastLSN = 0:0:0 (0x00000000:00000000:0000)                        \n\ndbi_DirtyPageLSN = 56:2416:1 (0x00000038:00000970:0001)                  dbi_RecoveryFlags = 0x00000000\n\ndbi_lastxact = 0x320                dbi_collation = 872468488           dbi_relstat = 0x41000000\n\ndbi_PartitionDbFlags = 0            dbi_familyGUID = 00000000-0000-0000-0000-000000000000\n\ndbi_maxLogSpaceUsed = 3493376       \ndbi_recoveryForkNameStack\n\n\n\nentry 0\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nm_guid = 90d16058-f1d1-4e96-8ec6-8d7bfda42f15                            \n\n\nentry 1\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nm_guid = 00000000-0000-0000-0000-000000000000                            \n\ndbi_differentialBaseGuid = 00000000-0000-0000-0000-000000000000          dbi_firstSysIndexes = 0001:00000014\n\ndbi_oldestBackupXactLSN = 0:0:0 (0x00000000:00000000:0000)               \n\ndbi_versionChangeLSN = 35:312:3 (0x00000023:00000138:0003)               dbi_mdUpgStat = 0x0004\n\ndbi_category = 0x0000000000000000   dbi_safetySequence = 0              \n\ndbi_dbMirrorId = 00000000-0000-0000-0000-000000000000                    \n\ndbi_pageUndoLsn = 0:0:0 (0x00000000:00000000:0000)                       dbi_pageUndoState = 0\n\ndbi_disabledSequence = 0            dbi_dbmRedoLsn = 0:0:0 (0x00000000:00000000:0000)\n\ndbi_dbmOldestXactLsn = 0:0:0 (0x00000000:00000000:0000)                  dbi_CloneCpuCount = 0\n\ndbi_CloneMemorySize = 0             dbi_updSysCatalog = 1900-01-01 00:00:00.000\n\ndbi_LogBackupChainOrigin = 0:0:0 (0x00000000:00000000:0000)              \n\ndbi_dbccLastKnownGood = 1900-01-01 00:00:00.000                          dbi_roleSequence = 0\n\ndbi_dbmHardenedLsn = 0:0:0 (0x00000000:00000000:0000)                    dbi_localState = 0\n\ndbi_safety = 0                      dbi_modDate = 1900-01-01 00:00:00.000\n\ndbi_verRDB = 251662378              dbi_delayedDurabilityOption = 0     \n\ndbi_acceleratedDatabaseRecoveryOption = 0                                dbi_stalePageDetectionOption = 0\n\ndbi_inMemorydbOption = 0            dbi_svcBrokerGUID = 00000000-0000-0000-0000-000000000000\n\ndbi_svcBrokerOptions = 0x00000000   dbi_dbmLogZeroOutstanding = 0       dbi_dbmLastGoodRoleSequence = 0\n\ndbi_dbmRedoQueue = 0                dbi_dbmRedoQueueType = 0            dbi_rmidRegistryValueDeleted = 0\n\ndbi_dbmConnectionTimeout = 0        dbi_AuIdNext = 1099511627953        \n\ndbi_MinSkipLsn = 0:0:0 (0x00000000:00000000:0000)                        dbi_commitTsOfcheckptLSN = 0\n\ndbi_dbEmptyVersionState = 0         dbi_CurrentGeneration = 0           \ndbi_EncryptionHistory\n\n\n\nScan 0\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\n\nScan 1\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\n\nScan 2\n\n\nhex (dec) = 0x00000000:00000000:0000 (0:0:0)                             \n\nEncryptionScanInfo:ScanId = 0       \n\ndbi_latestVersioningUpgradeLSN = 18:65:69 (0x00000012:00000041:0045)     \n\ndbi_PendingRestoreOutcomesId = 00000000-0000-0000-0000-000000000000      dbi_ContainmentState = 0\n\ndbi_hkRecoveryLSN = 0:0:0 (0x00000000:00000000:0000)                     \n\ndbi_hkLogTruncationLSN = 0:0:0 (0x00000000:00000000:0000)                dbi_hkCompatibilityMode = 0\n\ndbi_hkRootFile = 00000000-0000-0000-0000-000000000000                    dbi_hkRootFileWatermark = 0\n\ndbi_hkTrimLSN = 0:0:0 (0x00000000:00000000:0000)                         \n\ndbi_hkUpgradeLSN = 0:0:0 (0x00000000:00000000:0000)                      \n\ndbi_hkUndeployLSN = 0:0:0 (0x00000000:00000000:0000)                     dbi_databaseMaxSizeBytes = 0\n\ndbi_pvsRowsetIdRegular = 72057594042908672                               \n\ndbi_pvsRowsetIdLongTerm = 72057594042974208                              \n\nDBCC execution completed. If DBCC printed error messages, contact your system administrator."},"event_id":"1001","keywords":["Classic"],"provider_name":"Directory Synchronization","record_id":16087348,"task":"None"}}
This is a syslog message from a product called directory synchronization by directory synchronization. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 1001
senderHost: 192.168.10.55
sensitivity: normal
sourceInfo: unknown
streamName: directory synchronization
tags: ['v8', 'eventId:1001', 'directory synchronization', '1001']
vendorCode: 16087348