Microsoft-Windows-SUA-Psxss

Event	Title	Channel	Sample	Rule
1073742830	Domain Cache sweep interval set to {param1}.	Operational	N	N
1073742833	Synthesized POSIX offset for SID {param1}; computer {param2}.	Operational	N	N
1073742836	Connected to Mapping Server at host {param1} ({param2}).	Operational	N	N
3221226474	Subsystem for UNIX-based Applications status: {param1}.	Operational	N	N
3221226475	Unusable PsxOffset {param1} from domain SID {param2} with domain name {param3}.	Operational	N	N
3221226476	PSXSS has encountered a user or group ID with a value that requires careful …	Operational	N	N
3221226477	PSXSS has encountered a user or group ID with a value too large to convert to a …	Operational	N	N
3221226483	The status value {param1} was converted to EACCES.	Operational	N	N
3221226485	Could not connect to Mapping Server at host {param1}:while connecting {param2}.	Operational	N	N
3221226486	Could not open registry key {param1}: NtStatus {param2}.	Operational	N	N
3221226487	Internal Error: TLS Client not as expected at {param1} line {param2}.	Operational	N	N
3221226488	Unexpected Exception pid=.	Operational	N	N
3221226489	The POSIX offset for domain {param1} is {param2}; which is invalid.	Operational	N	N
3221226490	Subsystem for UNIX-based Applications is unable to load a DLL; pid=.	Operational	N	N
3221226491	Subsystem for UNIX-based Applications detected a hard error.	Operational	N	N
3221226493	Connection to port {param1} failed; Subsystem for UNIX-based Applications …	Operational	N	N
3221226495	Could not connect to Mapping Server at host {param1}:while connecting: Hostname …	Operational	N	N
3221226496	A fatal condition has occurred during subsystem startup.	Operational	N	N

Event ID 1073742830: Domain Cache sweep interval set to {param1}.

Channel: Operational

Fields #

Name	Description
`param1`

Event ID 1073742833: Synthesized POSIX offset for SID {param1}; computer {param2}.

Channel: Operational

Description

Synthesized POSIX offset for SID {param1}; computer {param2}. For more information about the compatibility of this operation with your configuration; see Knowledge Base article Q306552.

Message #

Synthesized POSIX offset for SID {param1}; computer {param2}. For more information about the compatibility of this operation with your configuration; see Knowledge Base article Q306552.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742836: Connected to Mapping Server at host {param1} ({param2}).

Channel: Operational

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226474: Subsystem for UNIX-based Applications status: {param1}.

Channel: Operational

Fields #

Name	Description
`param1`

Event ID 3221226475: Unusable PsxOffset {param1} from domain SID {param2} with domain name {param3}.

Channel: Operational

Description

Unusable PsxOffset {param1} from domain SID {param2} with domain name {param3}. See Knowledge Base article Q306552 for more information.

Message #

Unusable PsxOffset {param1} from domain SID {param2} with domain name {param3}. See Knowledge Base article Q306552 for more information.

Fields #

Name	Description
`param1`
`param2`
`param3`

Event ID 3221226476: PSXSS has encountered a user or group ID with a value that requires careful POSIX offset management.

Channel: Operational

Description

PSXSS has encountered a user or group ID with a value that requires careful POSIX offset management. See Knowledge Base article Q306552 for more information. The internal UID is 0x{param1}{param2}.

Message #

PSXSS has encountered a user or group ID with a value that requires careful POSIX offset management.  See Knowledge Base article Q306552 for more information. The internal UID is 0x{param1}{param2}.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226477: PSXSS has encountered a user or group ID with a value too large to convert to a uid_t; and converted it to a reserved UID value.

Channel: Operational

Message #

PSXSS has encountered a user or group ID with a value too large to convert to a uid_t; and converted it to a reserved UID value. See Knowledge Base article Q306552 for more information. The internal UID is 0x{param1}{param2}.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226483: The status value {param1} was converted to EACCES.

Channel: Operational

Description

The status value {param1} was converted to EACCES. While this is an informational message only; your system administrator should be informed that this event occurred.

Message #

The status value {param1} was converted to EACCES.  While this is an informational message only; your system administrator should be informed that this event occurred.

Fields #

Name	Description
`param1`

Event ID 3221226485: Could not connect to Mapping Server at host {param1}:while connecting {param2}.

Channel: Operational

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226486: Could not open registry key {param1}: NtStatus {param2}.

Channel: Operational

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226487: Internal Error: TLS Client not as expected at {param1} line {param2}.

Channel: Operational

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226488: Unexpected Exception pid=.

Channel: Operational

Description

Unexpected Exception pid={param1} cid={param2}.{param3} code={param4} fc={param5}.

Message #

Unexpected Exception pid={param1} cid={param2}.{param3} code={param4} fc={param5}

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`
`param5`

Event ID 3221226489: The POSIX offset for domain {param1} is {param2}; which is invalid.

Channel: Operational

Description

The POSIX offset for domain {param1} is {param2}; which is invalid. The domain will be ignored and inaccessible. See Knowledge Base article Q306552 for more information.

Message #

The POSIX offset for domain {param1} is {param2}; which is invalid.  The domain will be ignored and inaccessible. See Knowledge Base article Q306552 for more information.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226490: Subsystem for UNIX-based Applications is unable to load a DLL; pid=.

Channel: Operational

Description

Subsystem for UNIX-based Applications is unable to load a DLL; pid={param1} cid={param2}.{param3} code={param4} fc={param5}.

Message #

Subsystem for UNIX-based Applications is unable to load a DLL; pid={param1} cid={param2}.{param3} code={param4} fc={param5}

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`
`param5`

Event ID 3221226491: Subsystem for UNIX-based Applications detected a hard error.

Channel: Operational

Description

Subsystem for UNIX-based Applications detected a hard error. The exception vector contains: {param1}.

Message #

Subsystem for UNIX-based Applications detected a hard error. The exception vector contains: {param1}

Fields #

Name	Description
`param1`

Event ID 3221226493: Connection to port {param1} failed; Subsystem for UNIX-based Applications terminated during startup.

Channel: Operational

Fields #

Name	Description
`param1`

Event ID 3221226495: Could not connect to Mapping Server at host {param1}:while connecting: Hostname Resolution failed.

Channel: Operational

Message #

Could not connect to Mapping Server at host  {param1}:while connecting: Hostname Resolution failed.

Fields #

Name	Description
`param1`

Event ID 3221226496: A fatal condition has occurred during subsystem startup.

Channel: Operational

Description

A fatal condition has occurred during subsystem startup. The condition is {param1} and the status code is {param2}.

Message #

A fatal condition has occurred during subsystem startup. The condition is {param1} and the status code is {param2}

Fields #

Name	Description
`param1`
`param2`