次の方法で共有

MSFT_IPAM_IpAuditLogEntry class

  • [アーティクル]

Describes a log entry for an IP address audit event in IPAM.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.

Syntax

[UMLPackagePath("CIM::System::Logs"), ClassVersion("1.0.0"), dynamic, provider("IPAMServerPSProvider"), AMENDMENT]
class MSFT_IPAM_IpAuditLogEntry : CIM_LogEntry
{
  string   Caption;
  string   Description;
  string   ElementName;
  string   RecordFormat;
  string   RecordData;
  string   Locale;
  uint16   PerceivedSeverity;
  string   InstanceID;
  string   LogInstanceID;
  string   LogName;
  string   RecordID;
  datetime CreationTimeStamp;
  string   MessageID;
  string   Message;
  string   MessageArguments[];
  datetime TimeOfEvent;
  string   IPAddress;
  uint16   EventType;
  string   HostName;
  string   UserName;
  string   ClientId;
  string   UserDomainName;
  string   UserForestName;
  string   SourceServer;
  uint16   ServerType;
};

Members

The MSFT_IPAM_IpAuditLogEntry class has these types of members:

Methods

The MSFT_IPAM_IpAuditLogEntry class has these methods.

Method Description
RemoveIpAuditLog Deletes IP address audit events that occurred before the specified date.

Properties

The MSFT_IPAM_IpAuditLogEntry class has these properties.

Caption

Data type: string

Access type: Read-only

Qualifiers: MaxLen (64)

The Caption property is a short textual description (one- line string) of the object.

This property is inherited from CIM_ManagedElement.

ClientId

Data type: string

Access type: Read-only

The client Id from DHCP lease events.

CreationTimeStamp

Data type: datetime

Access type: Read-only

A LogEntry may include a timestamp for the entry.

This property is inherited from CIM_LogEntry.

Description

Data type: string

Access type: Read-only

The Description property provides a textual description of the object.

This property is inherited from CIM_ManagedElement.

ElementName

Data type: string

Access type: Read-only

A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.

This property is inherited from CIM_ManagedElement.

EventType

Data type: uint16

Access type: Read-only

The type of IP tracking for the event. This specifies the source of this particular audit data.

The possible values are.

None (0)

DHCPNewLease (1)

DHCPRenewLease (2)

DHCPReleaseLease (3)

DHCPLeaseExpired (4)

DHCPDeleteLease (5)

DHCPBootpLease (6)

DHCPBootpDynamicLease (7)

DHCPStatelessInfoReq (8)

DHCPStatelessClientPurged (9)

DCAuthentication (10)

NPSAuthentication (11)

HostName

Data type: string

Access type: Read-only

The hostname from DHCP lease events.

InstanceID

Data type: string

Access type: Read-only

Qualifiers: key

Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm:

<OrgID>:<LocalID>

Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>.

<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace.

For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'.

This property is inherited from CIM_LogEntry.

IPAddress

Data type: string

Access type: Read-only

The IP Address from DHCP lease events.

Locale

Data type: string

Access type: Read-only

A locale indicates a particular geographical, political, or cultural region. The Locale specifies the language used in creating the RecordForLog data. If the Locale property is empty, it is assumed that the default locale is en_US (English).

The locale string consists of three sub-strings, separated by underscores:

- The first sub-string is the language code, as specified in ISO639.

- The second sub-string is the country code, as specified in ISO3166.

- The third sub-string is a variant, which is vendor specific.

For example, US English appears as: "en_US_WIN", where the "WIN" variant would specify a Windows browser-specific collation (if one exists). Since the variant is not standardized, it is not commonly used and generally is limited to easily recognizable values ("WIN", "UNIX", "EURO", etc.) used in standard environments. The language and country codes are required; the variant may be empty.

This property is inherited from CIM_RecordForLog.

LogInstanceID

Data type: string

Access type: Read-only

Qualifiers: MaxLen (256)

The containing Log's InstanceID.

This property is inherited from CIM_LogEntry.

LogName

Data type: string

Access type: Read-only

Qualifiers: MaxLen (256)

The containing Log's Name. This property is available for backwards continuity with CIM_LogRecord.

This property is inherited from CIM_LogEntry.

Message

Data type: string

Access type: Read-only

Qualifiers: ModelCorrespondence ("CIM_LogEntry.MessageID", "CIM_LogEntry.MessageArguments")

The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity.

This property is inherited from CIM_LogEntry.

MessageArguments

Data type: string array

Access type: Read-only

Qualifiers: ModelCorrespondence ("CIM_LogEntry.Message", "CIM_LogEntry.MessageID")

An array containing the dynamic content of the message.

Each DYNAMIC_ELEMENT for the message referred to by the MessageID property shall be contained in MessageArguments whether the DYNAMIC_ELEMENT is included in the Message or not.

In addition, the entries in MessageArguments need to be in the same order as the DYNAMIC_ELEMENTs.

This property is inherited from CIM_LogEntry.

MessageID

Data type: string

Access type: Read-only

Qualifiers: ModelCorrespondence ("CIM_LogEntry.Message", "CIM_LogEntry.MessageArguments")

A string that uniquely identifies, within the scope of the OwningEntity, the format of the Message.

This property is inherited from CIM_LogEntry.

PerceivedSeverity

Data type: uint16

Access type: Read-only

Describes the severity of the Indication from the originator's point of view.

This property is inherited from CIM_RecordForLog.

The possible values are.

Unknown (0)

Other (1)

Information (2)

Informational only.

Degraded/Warning (3)

The user decides if action is needed.

Minor (4)

Not serious, but action is needed.

Major (5)

Immediate action is needed.

Critical (6)

Immediate action is needed for an issue with a broad scope or critical consequences.

Fatal/NonRecoverable (7)

It is too late to take action on the indicated error.

RecordData

Data type: string

Access type: Read-only

Qualifiers: ModelCorrespondence ("CIM_RecordForLog.RecordFormat")

A string containing LogRecord data.

If the corresponding RecordFormat property is <empty>, or cannot be parsed according to the recommended format, RecordData should be interpreted as a free-form string. If the RecordFormat property contains parseable format information (as recommended in the RecordFormat Description qualifier), the RecordData string SHOULD be parsed in accordance with this format. In this case, RecordData SHOULD begin with the delimiter character and this character SHOULD be used to separate substrings in the manner described. The RecordData string can then be parsed by the data consumer and appropriately typed.

This property is inherited from CIM_RecordForLog.

RecordFormat

Data type: string

Access type: Read-only

Qualifiers: ModelCorrespondence ("CIM_RecordForLog.RecordData")

A string describing the data structure of the information in the property, RecordData. If the RecordFormat string is <empty>, RecordData should be interpreted as a free-form string.

To describe the data structure of RecordData, the RecordFormat string should be constructed as follows:

- The first character is a delimiter character and is used to parse the remainder of the string into sub-strings.

- Each sub-string is separated by the delimiter character and should be in the form of a CIM property declaration (i.e., datatype and property name). This set of declarations may be used to interpret the similarly delimited RecordData property.

For example, using a '*' delimiter, RecordFormat = "*string ThisDay*uint32 ThisYear*datetime SomeTime"

may be used to interpret: RecordData = "*This is Friday*2002*20020807141000.000000-300".

This property is inherited from CIM_RecordForLog.

RecordID

Data type: string

Access type: Read-only

Qualifiers: MaxLen (256)

RecordID may be used to provide a representation of log entry ordering or pointers/handles for log entries.

This property is inherited from CIM_LogEntry.

ServerType

Data type: uint16

Access type: Read-only

The type of server that contained the event.

The possible values are.

None (0)

Ipam (1)

Dhcp (2)

Nps (3)

Dc (4)

SourceServer

Data type: string

Access type: Read-only

The name of the server that contained the event.

TimeOfEvent

Data type: datetime

Access type: Read-only

The date and time when the event occurred.

UserDomainName

Data type: string

Access type: Read-only

The domain name from domain controller login events.

UserForestName

Data type: string

Access type: Read-only

Forest name collected from DC logon events.

Windows Server 2012 R2: This property is unavailable prior to Windows Server 2016.

UserName

Data type: string

Access type: Read-only

The username from DC logon events and NPS events.

Requirements
Minimum supported client
 None supported
Minimum supported server
 Windows Server 2012 R2
Namespace
 RootMicrosoftIPAM
MOF
IPAMServerPSProvider.mof
DLL
IPAMServerPSProvider.dll

See also

CIM_LogEntry

IPAM Server WMI Provider Reference