Join Log in
Score:0
Duck of Death avatar Server

Windows NPS Logs - How to decode the class (25) attribute?

tr flag
Duck of Death

I'm wondering if there is a specific format for the "Class" attribute in Windows NPS logs.

Specifically, I'm looking at logs from Windows Server 2019 which are under %SystemRoot%\System32\LogFiles\NPS and have the filename format of INYYMMDD.log (e.g. IN230317.log).

I understand the logs for the most part, especially with help from:

Microsoft's "Interpret IAS Format Log Files" and DEEPSOFTWARE's "List of ias attributes"

The part I'm having trouble understanding is the ID 25, which maps to Attribute "Class":

25,311 1 10.10.42.17 02/26/2023 01:41:56 10438

The IP address is the server's own and I can see a date and time but this specific log is from March 23rd, 2023. Every log line in this specific file has the same date so I suppose it could be the last time the service was started but that's just a guess.

From looking through the "Client-Vendor" attributes via the DEEPSOFTWARE site it's indicating that 311 is Microsoft, which makes sense.

While I'm writing this I looked a bit closer at the "10438" and it seems to be a unique ID for each two entries, it increases sequentially.

So perhaps I've answered my own question... except for the "1" -- does anyone know what it means? Every line seems to contain it.

299
0 + 0
nps
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.