5.1 lcs.audit.backup.ended
- Event type:
lcs.audit.backup.ended - Defined in:
lcs.evman - Tier: essential
- Gating: none — audited unconditionally
- Cardinality: one record per occurrence
The record that a registry subtree backup finished, successfully or
otherwise. Pairs with lcs.audit.backup.started on the same key.
Emission failure here does not affect the result, which has already been determined by the time this is written.
5.1.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via caller | The user SID of the effective token the operation ran under. |
subject.token.integrity | uint.integrity | via caller | The integrity RID of the effective token. |
subject.token.id | uint.luid | via caller | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via caller | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via caller | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via caller | The impersonation level of the effective token. |
object.key.guid | bin.guid | required | The registry key an operation acted on. |
outcome.success | bool | required | Whether the operation succeeded. |
outcome.errno | int.errno | when outcome.success == false | The error the operation failed with, as a negative errno. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from lcs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.