All MIBs › EVNTAGENT-MIB › eventUserId
eventUserId
Module: EVNTAGENT-MIB
OID (symbolic): EVNTAGENT-MIB::eventUserId
OID (numeric): 1.3.6.1.4.1.311.1.13.1.9999.2
Node type: OBJECT-TYPE
Type: OCTET STRING
Access: read-only
Description: The user ID of the process that generated the event.
What is eventUserId?
This OCTET STRING holds the user ID of the process that generated the Windows event, as reported through the evntagent event-trap MIB. It is included as one of the variable bindings on account and service related traps such as w32LogonSuccess, w32LogonFailure, and w32ServiceStateChange, letting an admin trace a received trap back to the account context that triggered it. For example, on a w32LogonFailure trap this field might carry "SYSTEM" or a domain user name, pinpointing which account's failed logon fired the alert.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.311.1.13.1.9999.2 snmpwalk -v2c -c public <target> EVNTAGENT-MIB::eventUserId
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.311.1.13.1.9999.2.1 snmpget -v2c -c public <target> EVNTAGENT-MIB::eventUserId.1
Start monitoring Microsoft Windows servers with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the EVNTAGENT-MIB::eventUserId OID value, configure state conditions and alerts, and monitor any Microsoft Windows servers from a single console.
OID Breakdown
Upper-level ancestors (6 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.311 | microsoft | EVNTAGENT-MIB |
| 1.3.6.1.4.1.311.1 | software | EVNTAGENT-MIB |
| 1.3.6.1.4.1.311.1.13 | eventlog | EVNTAGENT-MIB |
| 1.3.6.1.4.1.311.1.13.1 | evntagent | EVNTAGENT-MIB |
| 1.3.6.1.4.1.311.1.13.1.9999 | eventData | EVNTAGENT-MIB |
| 1.3.6.1.4.1.311.1.13.1.9999.2 | eventUserId | EVNTAGENT-MIB |