c# - Microsoft-Windows-Security-SPP 记录级别等于 0 的信息

Question

我尝试从 EventLog 中检索和映射数据。为此，我使用 EventLogEntryType 作为LevelEventLog 条目的提供者。

public enum EventLogEntryType
{
  /// <summary><para>An error event. This indicates a significant problem the user should know about; usually a loss of functionality or data.</para></summary>
  Error = 1,
  /// <summary><para>A warning event. This indicates a problem that is not immediately significant, but that may signify conditions that could cause future problems.</para></summary>
  Warning = 2,
  /// <summary><para>An information event. This indicates a significant, successful operation.</para></summary>
  Information = 4,
  /// <summary><para>A success audit event. This indicates a security event that occurs when an audited access attempt is successful; for example, logging on successfully.</para></summary>
  SuccessAudit = 8,
  /// <summary><para>A failure audit event. This indicates a security event that occurs when an audited access attempt fails; for example, a failed attempt to open a file.</para></summary>
  FailureAudit = 16, // 0x00000010
}

但似乎由于某种原因Microsoft-Windows-Security-SPP信息日志有一个Level等于0而不是4。

我试图找出原因，但找不到任何描述该行为的文档。我想知道我是否应该在我的代码中处理该特定场景，或者它是某种Microsoft-Windows-Security-SPP我不应该处理的错误。

标签： c#windowsevent-logwindows-security