Metabase Auditing Event Messages

  • Article

Applies To: Windows Server 2003 with SP1

When metabase auditing is enabled, IIS tracks and logs each change to the metabase keys or properties using event messages in the Security log. Each change type is associated with an event message ID in the Security log. Metabase auditing records similar information for each event message.

For information about the common output produced for metabase auditing event messages, see Common Output in Metabase Auditing Event Messages.

The Metabase Auditing Event Messages table shows the event IDs, names, and descriptions for IIS 6.0 metabase auditing event messages.

Metabase Auditing Event Messages

Event ID Event Name Description Event Message Output

4500

IISADMIN_AUDIT_ADD_KEY

Shows information about a change to add a metabase key

See Metabase Audit Add Key

4501

IISADMIN_AUDIT_DELETE_KEY

Shows information about a change to delete a metabase key

See Metabase Audit Delete Key

4502

IISADMIN_AUDIT_DELETE_CHILD_KEYS

Shows information about a change to delete child keys from a metabase property

See Metabase Audit Delete Child Keys

4503

IISADMIN_AUDIT_COPY_KEY

Shows information about a change to copy a metabase key

See Metabase Audit Copy Key

4504

IISADMIN_AUDIT_RENAME_KEY

Shows information about a change to rename a metabase key

See Metabase Audit Rename Key

4505

IISADMIN_AUDIT_SET_DATA

Shows information about a change to add or change data in a metabase property

See Metabase Audit Set Data

4506

IISADMIN_AUDIT_DELETE_DATA

Shows information about a change to delete data from a metabase property

See Metabase Audit Delete Data

4507

IISADMIN_AUDIT_DELETE_ALL_DATA

Shows information about a change to delete all data from the metabase properties

See Metabase Audit Delete All Data

4508

IISADMIN_AUDIT_COPY_DATA

Shows information about a change to copy data from the metabase properties

See Metabase Audit Copy Data

4509

IISADMIN_AUDIT_SET_LAST_CHANGETIME

Shows the last time a change was made to the metabase

See Metabase Audit Set Last Change Time

4510

IISADMIN_AUDIT_RESTORE

Shows information about a change to restore the metabase

See Metabase Audit Restore

4511

IIADMIN_AUDIT_DELETE_BACKUP

Shows information about a change to delete the metabase backup

See Metabase Audit Delete Backup

4512

IISADMIN_AUDIT_IMPORT

Shows information about a change to import data into the metabase

See Metabase Audit Import

To view sample output for one metabase auditing event message, see Sample Metabase Auditing Event Log.

For information about using metabase auditing, see Metabase Auditing.

For information about enabling metabase auditing, see Auditing the Metabase.