eDirectory Events

This file contains a listing of all NsureTM Audit events logged by eDirectoryTM.

EventID Description Originator Title  Target Title  SubTarget Title Text1 Title Text2 Title  Text3 Title Value1 Title Value1 Type Value2 Title Value2 Type  Value3 Title  Value3 Type Group Title Group Type Data Title Data Type Display Schema. See  Display Schema Variables for details.
000B0001 Create Object Perpetrator Object DN Class Transaction Number N [$rC] [$SO]: A new eDirectory object called $SU (Class: $SY) was created by $SB\r\n
000B0002 Delete Object Perpetrator Object DN Class Transaction Number N [$rC] [$SO]: Object $SU (Class: $SY) was deleted by $SB\r\n
000B0003 Rename Object Perpetrator Object DN New Object DN Transaction Number N [$rC] [$SO]: Object $SU was renamed to $SY by $SB\r\n
000B0004 Move Object (Source) Perpetrator Old DN New DN Transaction Number N [$rC] [$SO]: Object $SU was moved to $SY by $SB\r\n
000B0005 Move Object (Destination) Perpetrator Old DN Transaction Number N [$rC] [$SO]: Object $SU was moved by $SB\r\n
000B0207 Move (Subtree) Perpetrator Source DN Destination DN Transaction Number N [$rC] [$SO]: Container $SU and it's subordinate objects were moved to $SY by $SB\r\n
000B020A Backlink SEV Perpetrator Object DN Transaction Number N [$rC] [$SO]: $SB caused a backlink operation to change Object $SU's Security Equivalence Vector\r\n
000B020B Backlink Operator Perpetrator Object DN Server DN Transaction Number N [$rC] [$SO]: $SB caused a backlink operation to change Object $SU's console operator privileges\r\n
000B020C Delete Subtree Perpetrator Subtree DN Number of Objects Deleted Transaction Number N [$rC] [$SO]: Container $SU and it's subordinate objects were deleted by $SB\r\n
000B021F Move Tree (Start) Perpetrator Subtree DN Destination DN Server ID Transaction Number N [$rC] [$SO]: Container $SU (starting from Server ID: $N1) is being moved to $SY by $SB\r\n
000B0220 Move Tree (End) Perpetrator Subtree DN Server DN Transaction Number N [$rC] [$SO]: Container $SU was moved.  The move started from Server $SY by $SB\r\n
000B0227 Name Collision Perpetrator Original DN Duplicate DN Transaction Number N [$rC] [$SO]: A name collision occurred between $SU (original) and $SY (duplicate)\r\n
000B0230 DSA Read Perpetrator Object DN Transaction Number N [$rC] [$SO]: A read operation was performed on object $SU by $SB\r\n
000B0301 Login Perpetrator Object DN Null-Password B NDS-Login B Transaction Number N [$rC] [$SO]: User $SU (using null password: $B1) logged in (NDS Login: $N2).\r\n
000B0302 Change Password Perpetrator Object DN Transaction Number N [$rC] [$SO]: User $SU password has been changed by $SB\r\n
000B0303 Logout Perpetrator Object DN Transaction Number N [$rC] [$SO]: User $SU has logged out\r\n
000B0309 Remove Object Perpetrator Object DN Transaction Number N [$rC] [$SO]: Object $SU has been removed from a container by $SB\r\n
000B030E Verify Password Perpetrator Object DN Transaction Number N [$rC] [$SO]: User $SU's password has been verified by $SB\r\n
000B030F Backup Object Perpetrator Object DN Transaction Number N [$rC] [$SO]: Object $SU has been backed up by $SB\r\n
000B0310 Restore Object Perpetrator Parent DN Object RDN Transaction Number N [$rC] [$SO]: Object $SY has been restored to $SU by $SB\r\n
000B0317 Remove Assoc. Directory Perpetrator Entry DN Transaction Number N [$rC] [$SO]: A file directory associated with object $SU was removed by $SB\r\n
000B0319 DS Stream Opened Perpetrator Entry DN Attribute Transaction Number N [$rC] [$SO]: Stream attribute $SY on object $SU was opened by $SB\r\n
000B0352 DS Stream Closed Perpetrator Entry DN Attribute Transaction Number N [$rC] [$SO]: Stream attribute $SY on object $SU was closed by $SB\r\n
000B031A List Subordinates Perpetrator Object DN Transaction Number N [$rC] [$SO]: A list Subordinate Entries operation has been performed on container $SU by $SB\r\n
000B031B List Containable Classes Perpetrator Object DN Transaction Number N [$rC] [$SO]: A list Containable Classes operation has been performed on object $SU by $SB\r\n
000B031E Mutate Entry Perpetrator Object DN New Class Transaction Number N [$rC] [$SO]: A Mutate Entry (Class: $SY) operation has been performed on object $SU by $SB\r\n
000B0323 Read Attribute Perpetrator Object DN Attribute Transaction Number N [$rC] [$SO]: Attribute $SU was read on object $SY by $SB\r\n
000B0324 Read References Perpetrator Object DN Transaction Number N [$rC] [$SO]: The references on object $SU have been read by $SB\r\n
000B032A Create Backlink Perpetrator Local DN Remote DN Transaction Number N [$rC] [$SO]: A backlink to object $SY has been created on object $SU by $SB\r\n
000B032B Check Console Operator Perpetrator Object DN Is Operator B Transaction Number N [$rC] [$SO]: Object $SU (Operator: $B1) has been checked for Console Operator rights by $SB\r\n
000B033A Read Object Info Perpetrator Object DN Transaction Number N [$rC] [$SO]: A Read Object Info operation has been performed on object $SU by $SB\r\n
000B033C Search Perpetrator Base DN Scope Nodes Transaction Number N [$rC] [$SO]: $SB performed a Search operation
000B033E Remove Backlink Perpetrator Object DN Remote DN Transaction Number N [$rC] [$SO]: A backlink was removed on object $SU by $SB\r\n
000B0341 Change Security Equals Perpetrator Object DN Equivalent DN Add/Remove Transaction Number N [$rC] [$SO]: Object $SY was added(1) or removed(0) on $SU's Security Equals attribute by $SB. Result: $N1\r\n
000B0343 Add Entry Perpetrator Object DN Attribute Transaction Number N [$rC] [$SO]: Attribute $SY was added on object $SU by $SB\r\n
000B0334 Add Property Perpetrator Object DN Security Flags Transaction Number N [$rC] [$SO]: An attribute was added to $SU by $SB.  Security: $N1  Flags: $N2\r\n
000B0335 Delete Property Perpetrator Object DN Transaction Number N [$rC] [$SO]: An attribute was deleted from $SU by $SB\r\n
000B0349 Modify RDN Perpetrator New DN Old DN Transaction Number N [$rC] [$SO]: Object $SY was renamed to $SU by $SB\r\n
000B0351 Allow Login Perpetrator Object DN Flags Transaction Number N [$rC] [$SO]: User $SU has been allowed to login (Flags: $N1) by $SB\r\n
000B0336 Add Group Member Perpetrator Object DN Member DN Transaction Number N [$rC] [$SO]: Object $SY has been added to object $SU by $SB\r\n
000B0337 Delete Group Member Perpetrator Object DN Member DN Transaction Number N [$rC] [$SO]: Object $SY has been removed from object $SU by $SB\r\n
000B0006 Add Value Perpetrator Object DN Attribute Attribute Value Schema Type N From Replica b Transaction Number N Binary Attribute Value [$rC] [$SO]: A value has been added to the attribute $SY on the object $SU by $SB : $SS\r\n
000B0007 Delete Value Perpetrator Object DN Attribute Attribute Value Schema Type N From Replica b Transaction Number N Binary Attribute Value [$rC] [$SO]: A value has been removed from the attribute $SY on the object $SU : $SS\r\n
000B0009 Delete Attribute Perpetrator Object DN Attribute Attribute Value Schema Type N From Replica b Transaction Number N Binary Attribute Value [$rC] [$SO]: Attribute $SU was removed from object $SY by $SB 
000B0318 Compare Attribute Value Perpetrator Object DN Attribute Transaction Number N [$rC] [$SO]: Attribute $SY on object $SU was compared by $SB\r\n
000B0344 Modify Object Perpetrator Object DN Attribute Transaction Number N Binary Attribute Value [$rC] [$SO]: Attribute $SY was modified on object $SU by $SB\r\n
000B0211 Update Class Definition Perpetrator Class Transaction Number N [$rC] [$SO]: Schema Class definition for $SU has been updated by $SB\r\n
000B0212 Update Attribute Definition Perpetrator Attribute Transaction Number N [$rC] [$SO]: Schema Attribute definition for $SY has been updated by $SB\r\n
000B0226 Schema Synchronized Perpetrator All Processed B Transaction Number N [$rC] [$SO]: A Schema Synchronization has occurred
000B0311 Define Attribute Perpetrator Attribute Transaction Number N [$rC] [$SO]: The definition for attribute $SU has been added to the schema by $SB\r\n
000B0312 Remove Attribute Perpetrator Attribute Transaction Number N [$rC] [$SO]: The definition for attribute $SU has been removed from the schema by $SB\r\n
000B0313 Remove Class Perpetrator Class Transaction Number N [$rC] [$SO]: The Schema Class $SU has been removed from the schema by $SB\r\n
000B0314 Define Class Perpetrator Class Transaction Number N [$rC] [$SO]: The Schema Class $SU has been added to the schema by $SB\r\n
000B0315 Modify Class Perpetrator Class Transaction Number N [$rC] [$SO]: The Schema Class $SU has been modified by $SB\r\n
000B0329 Synchronized Schema Perpetrator Tree Transaction Number N [$rC] [$SO]: The Schema on Tree $SU has been synchronized by $SB\r\n
000B032F Update Schema Perpetrator Tree Server DN Transaction Number N [$rC] [$SO]: An Update Schema operation as been performed  by $SB on Server $SY for the tree $SU\r\n
000B0330 Start Update Schema Perpetrator Tree Server DN Transaction Number N [$rC] [$SO]: A Start Update Schema operation as been performed  by $SB on Server $SY for the tree $SU\r\n
000B0331 End Update Schema Perpetrator Tree Server DN Transaction Number N [$rC] [$SO]: An End Update Schema operation as been performed by $SB on Server $SY for the tree $SU\r\n
000B0348 New Schema Epoch Perpetrator Tree Transaction Number N [$rC] [$SO]: A new schema epoch has been declared on tree $SU by $SB\r\n
000B000F Remote Server Down IP Address i Transaction Number N NetAddress [$rC] [$SO]: Remote Server at IP Address $i1 is down\r\n
000B0013 NCP Retry Expended IP Address i Transaction Number N NetAddress [$rC] [$SO]: The number of retries for an NCP request has been expended for IP Address $i1\r\n
000B0010 Remote Connection Cleared IP Address i Transaction Number N NetAddress [$rC] [$SO]: Remote connect cleared for IP Address $i1 by $SB\r\n
000B0014 DHost Module Loaded Module Name Transaction Number N [$rC] [$SO]: A Dhost module has been loaded by $SB\r\n
000B0015 DHost Module Unloaded Module Name Transaction Number N [$rC] [$SO]: A Dhost module has been unloaded by $SB\r\n
000B0201 Local Agent Opened State Transaction Number N [$rC] [$SO]: The local Directory agent has been opened by $SB. State: $N1\r\n
000B0202 Local Agent Closed State Transaction Number N [$rC] [$SO]: The local Directory agent has been closed by $SB. State: $N1\r\n
000B0204 DSA Bad Verb Perpetrator Verb Number Transaction Number N [$rC] [$SO]: An incorrect verb number ($N1) was given in a DSAgent request by $SB\r\n
000B0228 NLM Loaded Perpetrator NLM Name Handle Transaction Number N [$rC] [$SO]: NLM $SU has been loaded by $SB\r\n
000B0316 DS Counters Reset Perpetrator Server DN Transaction Number N [$rC] [$SO]: The internal eDirectory counters have been reset on server $SU by $SB\r\n
000B0333 DS Reloaded Perpetrator Tree Transaction Number N [$rC] [$SO]: eDirectory has been reloaded on tree $SU by $SB\r\n
000B0340 Create Namebase Perpetrator Transaction Number N [$rC] [$SO]: The Directory namebase has been created by $SB\r\n
000B0342 CRC Failure Server/Client Error Count Transaction Number N [$rC] [$SO]: A CRC failure has occurred on (Server=0
000B0347 Connection State Changed Transaction Number N [$rC] [$SO]: The connection state has been changed by $SB\r\n
000B0008 Close Stream Perpetrator Object DN Attribute Attribute Value Schema Type N From Replica b Transaction Number N Binary Attribute Value [$rC] [$SO]: Stream attribute $SY on object $SU has been closed.\r\n
000B0011 Check SEV Transaction Number N [$rC] [$SO]: The Security Equivalence Vector has been checked by $SB\r\n
000B0012 Update SEV Transaction Number N [$rC] [$SO]: The Security Equivalence Vector has been updated by $SB\r\n
000B000D Delete Unused External Reference Perpetrator Object DN Class Transaction Number N [$rC] [$SO]: An unused external reference has been deleted by $SB\r\n
000B0221 Recertified Public Key Perpetrator Object DN Transaction Number N [$rC] [$SO]: Object $SU's public key has been certified by $SB\r\n
000B0222 Generated CA Keys Perpetrator Object DN Transaction Number N [$rC] [$SO]: Certificate of Authority keys have been generated for object $SU by $SB\r\n
000B000A Set Bindery Context Transaction Number N [$rC] [$SO]: The Bindery context has been set on the server by $SB\r\n
000B000B Create Bindery Object Object Type Transaction Number N [$rC] [$SO]: Bindery object $SU (type: $N1) has been created by $SB\r\n
000B000C Delete Bindery Object Object Type Transaction Number N [$rC] [$SO]: Bindery object $SU (type: $N1) has been deleted by $SB\r\n
000B0203 Error Via Bindery Perpetrator Error Code Transaction Number N [$rC] [$SO]: Error Code $N1 was returned via the Bindery\r\n
000B0338 Change Property Security Perpetrator Object Property Security Transaction Number N [$rC] [$SO]: Security for the property $SY on bindery object $SU has been changed by $SB\r\n
000B0339 Change Object Security Perpetrator Object Security Transaction Number N [$rC] [$SO]: Security for the bindery object $SU has been changed by $SB\r\n
000B0345 Open Bindery Perpetrator Tree Transaction Number N [$rC] [$SO]: The Bindery has been opened on tree $SU by $SB\r\n
000B0346 Close Bindery Perpetrator Tree Transaction Number N [$rC] [$SO]: The Bindery has been closed on tree $SU by $SB\r\n
000B0208 No Replica Pointer Perpetrator Partition Transaction Number N [$rC] [$SO]: Partition $SU has no replica pointer\r\n
000B0209 Inbound Sync End Perpetrator Server DN Partition Number of Entries sent Transaction Number N [$rC] [$SO]: Inbound synchronization has completed on server $SU for partition $SY. $N1 entries has been sent\r\n
000B020D New Master Set Perpetrator Partition Transaction Number N [$rC] [$SO]: A new master replica for partition $SU has been set by $SB\r\n
000B020F Partition State Change Request Perpetrator Partition Partner Transaction Number N [$rC] [$SO]: The state of partition $SU has been changed by $SB\r\n
000B0213 Lost Entry Perpetrator Parent DN Object RDN Transaction Number N [$rC] [$SO]: A lost entry has been encountered.  Object: $SY Parent: $SU\r\n
000B0214 Purge Entry Failed Perpetrator Object DN Transaction Number N [$rC] [$SO]: Object $SU could not be purged\r\n
000B0215 Purge Start Perpetrator Partition Transaction Number N [$rC] [$SO]: A purge operation has started on partition $SU\r\n
000B0216 Purge End Perpetrator Partition Number of Entries Transaction Number N [$rC] [$SO]: A purge operation has ended on partition $SU\r\n
000B0217 FlatCleaner End Perpetrator Number of Entries Number of Values purged Transaction Number N [$rC] [$SO]: A Flatcleaner operation has removed $N2 total values from $N1\r\n
000B0218 One Replica Perpetrator Partition Transaction Number N [$rC] [$SO]: Partition $SU only has one replica\r\n
000B0219 Limber Done Perpetrator All Initialized Found new RDN Transaction Number N [$rC] [$SO]: A Limber operation has completed. All initialized: $B1  Found new RDN: $B2\r\n
000B021B Outbound Sync (Server) Start Perpetrator Partition Server DN  Replica Number Replica State/Type/Flags Transaction Number N [$rC] [$SO]: Outbound synchronization has begun for partition $SU on server $SY\r\n
000B021C Outbound Sync (Server) End Perpetrator Partition Server DN Replica Number Replica State/Type/Flags Transaction Number N [$rC] [$SO]: Outbound synchronization has ended for partition $SU on server $SY\r\n
000B0304 Added Replica Perpetrator Partition Server DN Replica Type Transaction Number N [$rC] [$SO]: A replica (type: $N1) of partition $SU has been added to server $SY by $SB\r\n
000B0305 Removed Replica Perpetrator Partition Server DN Transaction Number N [$rC] [$SO]: A replica of partition $SU has been removed from server $SY by $SB\r\n
000B0308 Changed Replica Type Perpetrator Partition Server DN Old Type New Type Transaction Number N [$rC] [$SO]: Partition $SU's replica type on server $SY has been changed from type $N1 to $N2 by $SB\r\n
000B030B Received Replica Updates Perpetrator Partition Transaction Number N [$rC] [$SO]: A replica update has been received on partition $SU\r\n
000B030C Repaired Timestamps Perpetrator Partition Transaction Number N [$rC] [$SO]: A replica's time stamps on partition $SU have been repaired\r\n
000B030D Send Replica Updates Perpetrator Partition Transaction Number N [$rC] [$SO]: A replica on partition $SU has sent an update during synchronization\r\n
000B031C Inspected Entry Perpetrator Object DN Transaction Number N [$rC] [$SO]: An Inspect Entry operation has been performed on object $SU by $SB\r\n
000B031D Resent Entry Perpetrator Object DN Transaction Number N [$rC] [$SO]: A Resend Entry operation has been performed on object $SU\r\n
000B031F Merged Entries Perpetrator Winner DN Looser RDN Transaction Number N [$rC] [$SO]: Object $SY has been merged with $SU by $SB\r\n
000B0325 Updated Replica Perpetrator Partition Object DN Transaction Number N [$rC] [$SO]: An Update Replica operation has been performed on object $SY (partition $SU) by $SB\r\n
000B0326 Start Update Replica Perpetrator Partition Transaction Number N [$rC] [$SO]: An Update Replica operation has been started on partition $SU by $SB\r\n
000B0327 End Update Replica Perpetrator Partition Transaction Number N [$rC] [$SO]: An Update Replica operation has been ended on partition $SU by $SB\r\n
000B034E EntryIDs Swapped Perpetrator Source DN Destination DN Transaction Number N [$rC] [$SO]: A Swap Entry ID operation has been performed by $SB.  Source object: $SU  Destination object: $SY\r\n
000B0210 Referral Created Perpetrator Object DN Partition Type Transaction Number N [$rC] [$SO]: A referral of type $N1 has been created by $SB on object $SU
000B021A Split Done Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: Partition $SU has been split by $SB.  Partition $SY has been created\r\n
000B021D Sync Partition Start Perpetrator Partition State Type Transaction Number N [$rC] [$SO]: Synchronization has stated on partition $SU (type $N2).  State: $N1\r\n
000B021E Sync Partition End Perpetrator Partition All Processed B Transaction Number N [$rC] [$SO]: Synchronization has ended on partition $SU.  All Processed: $B1\r\n
000B0223 Join Done Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: $SB has joined partition $SY with partition $SU\r\n
000B0224 Partition Locked Perpetrator Partition Transaction Number N [$rC] [$SO]: Partition $SU has been locked by $SB\r\n
000B0225 Partition Unlocked Perpetrator Partition Transaction Number N [$rC] [$SO]: Partition $SU has been unlocked by $SB\r\n
000B022B Lumber Done Perpetrator Transaction Number N [$rC] [$SO]: A Lumber Operation has completed\r\n
000B022C Backlink Procedure Done Perpetrator Transaction Number N [$rC] [$SO]: A Backlink Procedure has completed\r\n
000B022D Server Renamed Perpetrator New Name Transaction Number N [$rC] [$SO]: A server has been renamed to $SU by $SB\r\n
000B022E Synthetic Time Issued Perpetrator Partition Issuing Timestamp Partition Number of timestamps requested Transaction Number N [$rC] [$SO]: Synthetic Time has been by $SU for partition $SY\r\n
000B022F Server Address Changed Perpetrator Transaction Number N [$rC] [$SO]: A server's address has changed\r\n
000B0306 Split Partition Perpetrator Parent Partition New Partition Transaction Number N [$rC] [$SO]: Partition $SU has been split by $SB.  Partition $SY has been created\r\n
000B0307 Join Partitions Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: Partition $SY has joined partition $SU\r\n
000B030A Abort Partition Operation Perpetrator Parent New or Child Transaction Number N [$rC] [$SO]: The Partition Operation between partition $SU and $SY has been aborted by $SB\r\n
000B0320 Merge Trees Perpetrator Root DN Transaction Number N [$rC] [$SO]: Two eDirectory trees have been merged by $SB.  New tree name $SU\r\n
000B0321 Create Subref Perpetrator Subref DN Transaction Number N [$rC] [$SO]: A subordinate reference called $SU has been created by $SB
000B0322 List Partitions Perpetrator Partition Transaction Number N [$rC] [$SO]: A List Partitions operation has been performed on partition $SU by $SB\r\n
000B0328 Sync Partition Perpetrator Partition Transaction Number N [$rC] [$SO]: A Synchronize Partition operation has been performed on a replica of partition $SU by $SB\r\n
000B032C Change Tree Name Perpetrator Root DN New Name Transaction Number N [$rC] [$SO]: The tree name $SU has been changed to $SY by $SB\r\n
000B032D Start Join Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: A join operation between partition $SY and $SU has been started by $SB\r\n
000B032E Abort Join Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: A join operation between partition $SY and $SU has been aborted by $SB\r\n
000B0332 Move Tree (Source) Perpetrator Source DN Destination DN Transaction Number N [$rC] [$SO]: Tree $SU has been moved to $SY by $SB\r\n
000B0353 Move Tree (Target) Perpetrator Source DN Destination DN Transaction Number N [$rC] [$SO]: Tree $SU has been moved to $SY by $SB\r\n
000B033D Partition State Changed Perpetrator Partition Partner Func|Type State Transaction Number N [$rC] [$SO]: Partition $SU state has changed\r\n
000B033F Low Level Join Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: Partition $SY has had a low level join with partition $SU\r\n
000B034A Created Orphaned Partition Perpetrator Partition Target Partition Transaction Number N [$rC] [$SO]: An Orphan partition called $SY has been created from partition $SU by $SB\r\n
000B034B Removed Orphaned Partition Perpetrator Partition Transaction Number N [$rC] [$SO]: An Orphan partition has been removed from partition $SU by $SB\r\n
000B034C Linked Orphaned Partition Perpetrator Partition Target Partition Transaction Number N [$rC] [$SO]: Partition $SY has been linked with partition $SU by $SB\r\n
000B034D Unlinked Orphaned Partition Perpetrator Partition Target Partition Transaction Number N [$rC] [$SO]: Partition $SY has been unlinked from partition $SU by $SB\r\n
000B034F Low Level Split Perpetrator Parent Partition Child Partition Transaction Number N [$rC] [$SO]: A low-level join has been performed on partition $SU by $SB resulting in partition $SY\r\n
000B0354 ACL Changed Perpetrator Object DN ACL ACL Added B Transaction Number N [$rC] [$SO]: Access Control List modified on object $SU by $SB : $SS\r\n
000B0355 Login Enabled Perpetrator Object DN Transaction Number N [$rC] [$SO]: Login enabled for object $SU by $SB\r\n
000B0356 Login Disabled Perpetrator Object DN Transaction Number N [$rC] [$SO]: Login disabled for object $SU by $SB\r\n
000B0357 Intruder Detected Perpetrator Object DN Attribute Transaction Number N [$rC] [$SO]: Object $SU locked by intruder detection\r\n
000B0358 Login Failed Object DN Transaction Number N [$rC] [$SO]: Failed Login attempted on object $SB\r\n

Display Schema Variables

The following variables are used to extract values from an event when it is displayed using the template in the display schema field. Variables are constructed by specifying a $ character, followed by a two character code representing the variable format and value. For example:

$FV

Possible values for the variable format (F) and variable value (V) are as follows:

Format (F):
T - Time (UTC localized)
D - Date (UTC localized)
N - Number (32bit unsigned)
n - Number (32bit signed)
S - String
X - Hexadecimal Number
R - RFC822 format date/time
I - IPv4 Internet Address (network order)
i - IPv4 Internet Address (host order)
B - Boolean (Yes/No)
b - Boolean (True/False)
 
Value (V):
R - Source IP Address
C - Platform Agent Date
A - Audit Service Date
B - Originator
H - Originator Type
U - Target
V - Target Type
Y - SubTarget
1 - Numerical value 1
2 - Numerical value 2
3 - Numerical value 3
S - Text 1
T - Text 2
F - Text 3
O - Component
G - Group ID
I - Event ID
L - Log Level
M - MIME Hint
X - Data Size
D - Data