我有一组类似的电脑（Win 7），我正在创build一些事件监控规则，但我注意到我收到的东西有些奇怪。
组中的一台机器正在返回非常详细的日志消息：
<13>Mar 24 13:42:21 MACHINE123 AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=7.1.4.698761 Source=Microsoft-Windows-Security-Auditing Computer=MACHINE123.SOMECORP.Local User= Domain= EventID=4648 EventIDCode=4648 EventType=8 EventCategory=12544 RecordNumber=487779 TimeGenerated=1427218938 TimeWritten=1427218938 Level=0 Keywords=0 Task=0 Opcode=0 Message=A logon was attempted using explicit credentials. Subject: Security ID: SOMECORP\UserA Account Name: usera Account Domain: SOMECORP Logon ID: 0x1234567 Logon GUID: {AAAAAAAA-FFFF-E6AB-3B67-FE7473A02CE9} Account Whose Credentials Were Used: Account Name: [email protected] Account Domain: SOMECORP Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: EXCHANGE.SOMECORP.Local Additional Information: EXCHANGE.SOMECORP.Local Process Information: Process ID: 0xa04 Process Name: C:\Program Files\Microsoft Office 15\root\office15\outlook.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account's credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. 然而，其他人正在发送同一事件的缩短版本：
<13>Mar 24 14:33:32 MACHINE456 AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=7.1.4.698761 Source=Microsoft-Windows-Security-Auditing Computer=MACHINE456.SOMECORP.Local User= Domain= EventID=4648 EventIDCode=4648 EventType=8 EventCategory=12544 RecordNumber=505638 TimeGenerated=1427222009 TimeWritten=1427222009 Level=0 Keywords=0 Task=0 Opcode=0 Message=SOMECORP\UserB USERB SOMECORP 0x7654321 {BBBBBBBB-EEEE-3CB9-D00A-A56E3F838596} [email protected] SOMECORP {00000000-0000-0000-0000-000000000000} EXCHANGE.SOMECORP.Local EXCHANGE.SOMECORP.Local 0x1230 C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE - -
我遇到的问题是我的事件处理器不parsing后面的消息，因为字段描述符不在其中。 我宁愿不需要花费大量的时间来设置一个parsing器的自定义实现，而这个parsing器应该是现成的。
为什么同一个事件会在不同的计算机上生成两个截然不同的日志消息？ 有什么configuration或政策选项，我应该看看有关使这些格式相同？