Linux syslog and msg.id

[RSAAdmin]

Where does Security Analytics get the msg.id from a Linux syslog.

Here is an example:

sessionid	=	758292139
time	=	2014-10-30T13:38:01.0
size	=	130
device.ip	=	10.71.108.25
medium	=	32
device.type	=	"rhlinux"
device.class	=	"Unix"
header.id	=	"0016"
client	=	"CROND"
user.dst	=	"root"
username.grp.alt	=	"sensitive_user"
username.grp.alt	=	"service_user"
action	=	"CMD (/etc/netwitness/ng/logcollector/lctwin)"
alias.host	=	"log-vlc1"
level	=	6
msg.id	=	"00091"
event.cat.name	=	"System.Normal Conditions.Daemons"

Is msg.id "00091" coming from the syslog event? 

Here is the raw log:

Oct 30 17:38:01 log-vlc1 CROND[10436]: (root) CMD (/etc/netwitness/ng/logcollector/lctwin)

Is there a chart or reference of these message IDs?

[RSAAdmin]

In this case msg.id is not coming from raw log. It is defined in content definition

[RSAAdmin]

Where may I look to explore the content definition of these types of events?

[RSAAdmin]

You need to access actual file : <log decoder>/etc/netwitness/ng/envision/etc/devices/rhlinux/v20_rhlinuxmsg.xml

[RSAAdmin]

Thanks!