Hayabusa: the record id is one event

The record id picks one event

A timeline row can show a record id, the number of that event inside the log file. That number, with the log it belongs to, is how you open that event again. It is not the event id, which many events share.

Quoting only the event id can point at a whole type. Quoting the record id points at one event.

Same type, different records

Two rows with event id 4624 and record ids 18421 and 18422 are two events of that type. Do not collapse them because the type matches. Their times, accounts, or computers can differ, and even if those match you still have two records until you show they are the same id.

If the record id was not exported, write “record id not in this export.” Do not use the row number in your spreadsheet as the record id.

What to file

File the log or channel you have, the record id, and the event id. When you say “this logon,” include the record id. When you say “this type,” include the event id and do not pretend it is one event.

Worked case: two 4624 rows treated as one

A lab Hayabusa sheet has two rows, event id 4624, record ids 18421 and 18422, a minute apart. A draft describes one logon and drops 18422 because the event id already appeared.

The note lists both record ids. They are two events of type 4624. The minute between them stays. Neither id is deleted to tidy the sheet.

event id: 4624 on both rows
record id: 18421
record id: 18422
write: two events
not: one logon because the type matches