Windows event logEvent ID 4
7 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 4
7 channels
- Microsoft-Windows-Sysmon/OperationalSysmon service state changedMicrosoft-Windows-Sysmon%4Operational.evtx
- OpenSSH/OperationalSSH activityOpenSSH%4Operational.evtx
- Microsoft-Windows-Bits-Client/OperationalBITS job completionMicrosoft-Windows-Bits-Client%4Operational.evtx
- Microsoft-Windows-Ntfs/OperationalNTFS Volume Mount – Volume successfully mountedMicrosoft-Windows-Ntfs%4Operational.evtx
- Microsoft-Windows-User Profile Service/OperationalAn account was logged offMicrosoft-Windows-User Profile Service%4Operational.evtx
- Microsoft-Windows-WER-Diag/OperationalApplication Crash on LaunchMicrosoft-Windows-WER-Diag%4Operational.evtx
- CrowdStrike-Falcon Sensor-CSFalconService/OperationalCrowdStrike AlertCrowdStrike-Falcon Sensor-CSFalconService%4Operational.evtx