Event field name

Field value

DeviceAction

service status changed

DeviceExternalID

Service ID.

DeviceProcessName

Service name.

DeviceFacility

Service type.

DestinationAddress

Address of the machine where the service was started.

DestinationHostName

FQDN of the machine where the service was started.

DeviceCustomString1

green, yellow, or red

DeviceCustomString1Label

new status

DeviceCustomString2

green, yellow, or red

DeviceCustomString2Label

old status