This option logs event properties other than the standard properties to the SystemEventsProperties table. A single event can potentially have multiple properties, so selecting this option can result in multple writes. With syslog data, however, there are seldom any additional properties. They most often occur when you use the "PostProcess" action to define your own properties. Additional properties are typically found in SETP received data orinating from an event log monitor, file monitor or database monitor (plus other monitors, but these are the most prominent ones).
For example, with Event Log data received via SETP, these properties contain the actualy Windows event properties and the event data. Please note that this does not apply to event log messages received via syslog, because they are no native events but rather syslog data.
A full list of event properties can be found here:
http://www.winsyslog.com/en/Manual/curr ... placer.htm
I hope this clarifies. I'll also ask the doc team to update the manuals accordingly.
Best regards,
Rainer Gerhards