RecordID

Monotonically-increasing per-channel record number, assigned by the EventLog service at write time. Gaps suggest deletion or clearing. Don't confuse with the EventID (which identifies what kind of event) or with the Sysmon EventRecordID.