Kaspersky Security Center 13.1 Help

Event types

Event types

Each Kaspersky Security Center component has its own set of event types. This section lists types of events that occur in Kaspersky Security Center Administration Server, Network Agent, iOS MDM Server, and Exchange Mobile Device Server. Types of events that occur in Kaspersky applications are not listed in this section.

In this section

Data structure of event type description

Event type display name	Event type ID	Event type	Description	Default storage term
License limit has been exceeded	4099	KLSRV_EV_LICENSE_CHECK_MORE_110	Once a day Kaspersky Security Center checks whether a licensing restriction is exceeded. Events of this type occur when Administration Server detects that some licensing limits are exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license exceeds 110% of the total number of units covered by the license. Even when this event occurs, client devices are protected. You can respond to the event in the following ways: Look through the managed devices list. Delete devices that are not in use. Provide a license for more devices (add a valid activation code or a key file to Administration Server). Kaspersky Security Center determines the rules to generate events when a licensing restriction is exceeded.	180 days
Virus outbreak	26 (for File Threat Protection)	GNRL_EV_VIRUS_OUTBREAK	Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period of time. You can respond to the event in the following ways: Configure the threshold in the Administration Server properties. Create a stricter policy that will be activated, or create a task that will be run, at the occurrence of this event.	180 days
Virus outbreak	27 (for Mail Threat Protection)	GNRL_EV_VIRUS_OUTBREAK	Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period of time. You can respond to the event in the following ways: Configure the threshold in the Administration Server properties. Create a stricter policy that will be activated, or create a task that will be run, at the occurrence of this event.	180 days
Virus outbreak	28 (for firewall)	GNRL_EV_VIRUS_OUTBREAK	Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period of time. You can respond to the event in the following ways: Configure the threshold in the Administration Server properties. Create a stricter policy that will be activated, or create a task that will be run, at the occurrence of this event.	180 days
Device has become unmanaged	4111	KLSRV_HOST_OUT_CONTROL	Events of this type occur if a managed device is visible on the network but has not connected to Administration Server for a specific period of time. Find out what prevents the proper functioning of Network Agent on the device. Possible causes include network issues and removal of Network Agent from the device.	180 days
Device status is Critical	4113	KLSRV_HOST_STATUS_CRITICAL	Events of this type occur when a managed device is assigned the Critical status. You can configure the conditions under which the device status is changed to Critical.	180 days
The key file has been added to the denylist	4124	KLSRV_LICENSE_BLACKLISTED	Events of this type occur when Kaspersky has added the activation code or key file that you use to the denylist. Contact Technical Support for more details.	180 days
Limited functionality mode	4130	KLSRV_EV_LICENSE_SRV_LIMITED_MODE	Events of this type occur when Kaspersky Security Center starts to operate with basic functionality, without Vulnerability and Patch Management and without Mobile Device Management features. Following are causes of, and appropriate responses to, the event: License term has expired. Provide a license to use the full functionality mode of Kaspersky Security Center (add a valid activation code or a key file to Administration Server). Administration Server manages more devices than specified by the license limit. Move devices from the administration groups of an Administration Server to those of another Administration Server (if the license limit of the other Administration Server allows).	180 days
License expires soon	4129	KLSRV_EV_LICENSE_SRV_EXPIRE_SOON	Events of this type occur when the commercial license expiration date is approaching. Once a day Kaspersky Security Center checks whether a license expiration date is approaching. Events of this type are published 30 days, 15 days, 5 days and 1 day before the license expiration date. You cannot change the number of days. If the Administration Server is turned off on the specified day before the license expiration date, the event will not be published until the next day. When the commercial license expires, Kaspersky Security Center provides only basic functionality. You can respond to the event in the following ways: Make sure that a reserve license key is added to Administration Server. If you use a subscription, make sure to renew it. An unlimited subscription is renewed automatically if it has been prepaid to the service provider by the due date.	180 days
Certificate has expired	4132	KLSRV_CERTIFICATE_EXPIRED	Events of this type occur when the Administration Server certificate for Mobile Device Management expires. You need to update the expired certificate. You can configure automatic updates of certificates by selecting the Reissue certificate automatically if possible check box in the certificate issuance settings.	180 days
Updates for Kaspersky software modules have been revoked	4142	KLSRV_SEAMLESS_UPDATE_REVOKED	Events of this type occur if seamless updates have been revoked (Revoked status is displayed for these updates) by Kaspersky technical specialists; for example, they must be updated to a newer version. The event concerns Kaspersky Security Center patches and does not concern modules of managed Kaspersky applications. The event provides the reason that the seamless updates are not installed.	180 days

Event type display name	Event type ID	Event type	Description	Default storage term
Runtime error	4125	KLSRV_RUNTIME_ERROR	Events of this type occur because of unknown issues. Most often these are DBMS issues, network issues, and other software and hardware issues. Details of the event can be found in the event description.	180 days
Limit of installations has been exceeded for one of the licensed applications groups	4126	KLSRV_INVLICPROD_EXCEDED	Administration Server generates events of this type periodically (every hour). Events of this type occur if in Kaspersky Security Center you manage license keys of third-party applications and if the number of installations has exceeded the limit set by the license key of the third-party application. You can respond to the event in the following ways: Look through the managed devices list. Delete the third-party application from devices on which the application is not in use. Use a third-party license for more devices. You can manage license keys of third-party applications using the functionality of licensed applications groups. A licensed applications group includes third-party applications that meet criteria set by you.	180 days
Failed to poll the cloud segment	4143	KLSRV_KLCLOUD_SCAN_ERROR	Events of this type occur when Administration Server fails to poll a network segment in a cloud environment. Read the details in the event description and respond accordingly.	Not stored
Failed to copy the updates to the specified folder	4123	KLSRV_UPD_REPL_FAIL	Events of this type occur when software updates are copied to an additional shared folder(s). You can respond to the event in the following ways: Check whether the user account that is employed to gain access to the folder(s) has write permission. Check whether a user name and/or a password to the folder(s) changed. Check the internet connection, as it might be the cause of the event. Follow the instructions to update databases and software modules.	180 days
No free disk space	4107	KLSRV_DISK_FULL	Events of this type occur when the hard drive of the device on which Administration Server is installed runs out of free space. Free up disk space on the device.	180 days
Shared folder is not available	4108	KLSRV_SHARED_FOLDER_UNAVAILABLE	Events of this type occur if the shared folder of Administration Server is not available. You can respond to the event in the following ways: Check whether the Administration Server (where the shared folder is located) is turned on and available. Check whether a user name and/or a password to the folder is/are changed. Check the network connection.	180 days
The Administration Server database is unavailable	4109	KLSRV_DATABASE_UNAVAILABLE	Events of this type occur if the Administration Server database becomes unavailable. You can respond to the event in the following ways: Check whether the remote server that has SQL Server installed is available. View the DBMS logs to discover the reason for Administration Server database unavailability. For example, because of preventive maintenance a remote server with SQL Server installed might be unavailable.	180 days
No free space in the Administration Server database	4110	KLSRV_DATABASE_FULL	Events of this type occur when there is no free space in the Administration Server database. Administration Server does not function when its database has reached its capacity and when further recording to the database is not possible. Following are the causes of this event, depending on the DBMS that you use, and appropriate responses to the event: You use the SQL Server Express Edition DBMS: In the SQL Server Express documentation, review the database size limit for the version you use. Probably your Administration Server database has exceeded the database size limit. Limit the number of events to store in the Administration Server database. In the Administration Server database there are too many events sent by the Application Control component. You can change the settings of the Kaspersky Endpoint Security for Windows policy relating to Application Control event storage in the Administration Server database. You use a DBMS other than SQL Server Express Edition: Do not limit the number of events to store in the Administration Server database. Reduce the list of events to store in the Administration Server database. Review the information on DBMS selection.	180 days

Event type display name	Event type ID	Event type	Description	Default storage term
A frequent event has been detected		KLSRV_EVENT_SPAM_EVENTS_DETECTED	Events of this type occur when Administration Server detects a frequent event on a managed device. Refer to the following section for details: Blocking frequent events.	90 days
License limit has been exceeded	4098	KLSRV_EV_LICENSE_CHECK_100_110	Once a day Kaspersky Security Center checks whether a licensing restriction is exceeded. Events of this type occur when Administration Server detects that some licensing limits are exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license constitute 100% to 110% of the total number of units covered by the license. Even when this event occurs, client devices are protected. You can respond to the event in the following ways: Look through the managed devices list. Delete devices that are not in use. Provide a license for more devices (add a valid activation code or a key file to Administration Server). Kaspersky Security Center determines the rules to generate events when a licensing restriction is exceeded.	90 days
Device has remained inactive on the network for a long time	4103	KLSRV_EVENT_HOSTS_NOT_VISIBLE	Events of this type occur when a managed device shows inactivity for some time. Most often, this happens when a managed device is decommissioned. You can respond to the event in the following ways: Manually remove the device from the list of managed devices. Specify the time interval after which the Device has remained inactive on the network for a long time event is created by using Administration Console or by using Kaspersky Security Center 13.1 Web Console. Specify the time interval after which the device is automatically removed from the group by using Administration Console or by using Kaspersky Security Center 13.1 Web Console.	90 days
Conflict of device names	4102	KLSRV_EVENT_HOSTS_CONFLICT	Events of this type occur when Administration Server considers two or more managed devices as a single device. Most often this happens when a cloned hard drive was used for software deployment on managed devices and without switching the Network Agent to the dedicated disk cloning mode on a reference device. To avoid this issue, switch Network Agent to the disk cloning mode on a reference device before cloning the hard drive of this device.	90 days
Device status is Warning	4114	KLSRV_HOST_STATUS_WARNING	Events of this type occur when a managed device is assigned the Warning status. You can configure the conditions under which the device status is changed to Warning.	90 days
Limit of installations will soon be exceeded for one of the licensed applications groups	4127	KLSRV_INVLICPROD_FILLED	Events of this type occur when the number of installations for third-party applications included in a licensed applications group reaches 90% of the maximum allowed value specified in the license key properties. You can respond to the event in the following ways: If the third-party application is not in use on some of the managed devices, delete the application from these devices. If you expect that the number of installations for the third-party application will exceed the allowed maximum in the near future, consider obtaining a third-party license for a greater number of devices in advance. You can manage license keys of third-party applications using the functionality of licensed applications groups.	90 days
Certificate has been requested	4133	KLSRV_CERTIFICATE_REQUESTED	Events of this type occur when a certificate for Mobile Device Management fails to be automatically reissued. Following might be the causes and appropriate responses to the event: Automatic reissue was initiated for a certificate for which the Reissue certificate automatically if possible option is disabled. This might be due to an error that occurred during creation of the certificate. Manual reissue of the certificate might be required. If you use an integration with a public key infrastructure, the cause might be a missing SAM-Account-Name attribute of the account used for integration with PKI and for issuance of the certificate. Review the account properties.	90 days
Certificate has been removed	4134	KLSRV_CERTIFICATE_REMOVED	Events of this type occur when an administrator removes any type of certificate (General, Mail, VPN) for Mobile Device Management. After removing a certificate, mobile devices connected via this certificate will fail to connect to Administration Server. This event might be helpful when investigating malfunctions associated with the management of mobile devices.	90 days
APNs certificate has expired	4135	KLSRV_APN_CERTIFICATE_EXPIRED	Events of this type occur when an APNs certificate expires. You need to manually renew the APNs certificate and install it on an iOS MDM Server.	Not stored
APNs certificate expires soon	4136	KLSRV_APN_CERTIFICATE_EXPIRES_SOON	Events of this type occur when there are fewer than 14 days left before the APNs certificate expires. When the APNs certificate expires, you need to manually renew the APNs certificate and install it on an iOS MDM Server. We recommend that you schedule the APNs certificate renewal in advance of the expiration date.	Not stored
Failed to send the FCM message to the mobile device	4138	KLSRV_GCM_DEVICE_ERROR	Events of this type occur when Mobile Device Management is configured to use Google Firebase Cloud Messaging (FCM) for connecting to managed mobile devices with an Android operating system and FCM Server fails to handle some of the requests received from Administration Server. It means that some of the managed mobile devices will not receive a push notification. Read the HTTP code in the details of the event description and respond accordingly. For more information on the HTTP codes received from FCM Server and related errors, please refer to the Google Firebase service documentation (see chapter "Downstream message error response codes").	90 days
HTTP error sending the FCM message to the FCM server	4139	KLSRV_GCM_HTTP_ERROR	Events of this type occur when Mobile Device Management is configured to use Google Firebase Cloud Messaging (FCM) for connecting managed mobile devices with the Android operating system and FCM Server reverts to the Administration Server a request with a HTTP code other than 200 (OK). Following might be the causes and appropriate responses to the event: Problems on the FCM server side. Read the HTTP code in the details of the event description and respond accordingly. For more information on the HTTP codes received from FCM Server and related errors, please refer to the Google Firebase service documentation (see chapter "Downstream message error response codes"). Problems on the proxy server side (if you use proxy server). Read the HTTP code in the details of the event and respond accordingly.	90 days
Failed to send the FCM message to the FCM server	4140	KLSRV_GCM_GENERAL_ERROR	Events of this type occur due to unexpected errors on the Administration Server side when working with the Google Firebase Cloud Messaging HTTP protocol. Read the details in the event description and respond accordingly. If you cannot find the solution to an issue on your own, we recommend that you contact Kaspersky Technical Support.	90 days
Little free space on the hard drive	4105	KLSRV_NO_SPACE_ON_VOLUMES	Events of this type occur when the hard drive of the device on which Administration Server is installed almost runs out of free space. Free up disk space on the device.	90 days
Little free space in the Administration Server database	4106	KLSRV_NO_SPACE_IN_DATABASE	Events of this type occur if space in the Administration Server database is too limited. If you do not remedy the situation, soon the Administration Server database will reach its capacity and Administration Server will not function. Following are the causes of this event, depending on the DBMS that you use, and the appropriate responses to the event. You use the SQL Server Express Edition DBMS: In SQL Server Express documentation, review the database size limit for the version you use. Probably your Administration Server database is about to reach the database size limit. Limit the number of events to store in the Administration Server database. In the Administration Server database there are too many events sent by the Application Control component. You can change the settings of the Kaspersky Endpoint Security for Windows policy relating to Application Control event storage in the Administration Server database. You use a DBMS other than SQL Server Express Edition: Do not limit the number of events to store in the Administration Server database Reduce the list of events to store in the Administration Server database Review the information on DBMS selection.	90 days
Connection to the secondary Administration Server has been interrupted	4116	KLSRV_EV_SLAVE_SRV_DISCONNECTED	Events of this type occur when a connection to the secondary Administration Server is interrupted. Read the Kaspersky Event Log on the device where the secondary Administration Server is installed and respond accordingly.	90 days
Connection to the primary Administration Server has been interrupted	4118	KLSRV_EV_MASTER_SRV_DISCONNECTED	Events of this type occur when a connection to the primary Administration Server is interrupted. Read the Kaspersky Event Log on the device where the primary Administration Server is installed and respond accordingly.	90 days
New updates for Kaspersky software modules have been registered	4141	KLSRV_SEAMLESS_UPDATE_REGISTERED	Events of this type occur when Administration Server registers new updates for the Kaspersky software installed on managed devices that require approval to be installed. Approve or decline the updates by using Administration Console or using Kaspersky Security Center Web Console.	90 days
Deletion of events from the database has started because the limit on the number of events was exceeded	4145	KLSRV_EVP_DB_TRUNCATING	Events of this type occur when deletion of old events from the Administration Server database has started after the Administration Server database capacity is reached. You can respond to the event in the following ways: Change the maximum number of events stored in the Administration Server database Reduce the list of events to store in the Administration Server database	Not stored
Events have been deleted from the database because the limit on the number of events was exceeded	4146	KLSRV_EVP_DB_TRUNCATED	Events of this type occur when old events have been deleted from the Administration Server database after the Administration Server database capacity is reached. You can respond to the event in the following ways: Change the allowed maximum number of events to be stored in the Administration Server database Reduce the list of events to store in the Administration Server database	Not stored

Event type display name	Event type ID	Event type	Default storage term	Remarks
Over 90% of the license key is used up	4097	KLSRV_EV_LICENSE_CHECK_90	30 days
New device has been detected	4100	KLSRV_EVENT_HOSTS_NEW_DETECTED	30 days
Device has been automatically added to the group	4101	KLSRV_EVENT_HOSTS_NEW_REDIRECTED	30 days
Device has been removed from the group: inactive on the network for a long time	4104	KLSRV_INVISIBLE_HOSTS_REMOVED	30 days
Limit of installations will soon be exceeded (more than 95% is used up) for one of the licensed applications groups	4128	KLSRV_INVLICPROD_EXPIRED_SOON	30 days
Files have been found to send to Kaspersky for analysis	4131	KLSRV_APS_FILE_APPEARED	30 days
FCM Instance ID has changed on this mobile device	4137	KLSRV_GCM_DEVICE_REGID_CHANGED	30 days
Updates have been successfully copied to the specified folder	4122	KLSRV_UPD_REPL_OK	30 days
Connection to the secondary Administration Server has been established	4115	KLSRV_EV_SLAVE_SRV_CONNECTED	30 days
Connection to the primary Administration Server has been established	4117	KLSRV_EV_MASTER_SRV_CONNECTED	30 days
Databases have been updated	4144	KLSRV_UPD_BASES_UPDATED	30 days
Audit: Connection to the Administration Server has been established	4147	KLAUD_EV_SERVERCONNECT	30 days
Audit: Object has been modified	4148	KLAUD_EV_OBJECTMODIFY	30 days	This event tracks changes in the following objects: Administration group Security group User Package Task Policy Server Virtual server
Audit: Object status has changed	4150	KLAUD_EV_TASK_STATE_CHANGED	30 days	For example, this event occurs when a task has failed with an error.
Audit: Group settings have been modified	4149	KLAUD_EV_ADMGROUP_CHANGED	30 days
Audit: Connection to Administration Server has been terminated	4151	KLAUD_EV_SERVERDISCONNECT	30 days
Audit: Object properties have been modified	4152	KLAUD_EV_OBJECTPROPMODIFIED	30 days	This event tracks changes in the following properties: User License Server Virtual server
Audit: User permissions have been modified	4153	KLAUD_EV_OBJECTACLMODIFIED	30 days

Event type display name	Event type ID	Event type	Default storage term
Warning has been returned during installation of the software module update	7701	KLNAG_EV_PATCH_INSTALL_WARNING	30 days
Third-party software update installation has completed with a warning	7696	KLNAG_EV_3P_PATCH_INSTALL_WARNING	30 days
Third-party software update installation has been postponed	7698	KLNAG_EV_3P_PATCH_INSTALL_SLIPPED	30 days
Incident has occurred	549	GNRL_EV_APP_INCIDENT_OCCURED	30 days
KSN Proxy has started. Failed to check KSN for availability	7718	KSNPROXY_STARTED_CON_CHK_FAILED	30 days

Event type display name	Event type ID	Event type	Default storage term
Update for software modules has been installed successfully	7699	KLNAG_EV_PATCH_INSTALLED_SUCCESSFULLY	30 days
Installation of the software module update has started	7700	KLNAG_EV_PATCH_INSTALL_STARTING	30 days
Application has been installed	7703	KLNAG_EV_INV_APP_INSTALLED	30 days
Application has been uninstalled	7704	KLNAG_EV_INV_APP_UNINSTALLED	30 days
Monitored application has been installed	7705	KLNAG_EV_INV_OBS_APP_INSTALLED	30 days
Monitored application has been uninstalled	7706	KLNAG_EV_INV_OBS_APP_UNINSTALLED	30 days
Third-party application has been installed	7707	KLNAG_EV_INV_CMPTR_APP_INSTALLED	30 days
New device has been added	7708	KLNAG_EV_DEVICE_ARRIVAL	30 days
Device has been removed	7709	KLNAG_EV_DEVICE_REMOVE	30 days
New device has been detected	7710	KLNAG_EV_NAC_DEVICE_DISCOVERED	30 days
Device has been authorized	7711	KLNAG_EV_NAC_HOST_AUTHORIZED	30 days
Windows Desktop Sharing: File has been read	7712	KLUSRLOG_EV_FILE_READ	30 days
Windows Desktop Sharing: File has been modified	7713	KLUSRLOG_EV_FILE_MODIFIED	30 days
Windows Desktop Sharing: Application has been started	7714	KLUSRLOG_EV_PROCESS_LAUNCHED	30 days
Windows Desktop Sharing: Started	7715	KLUSRLOG_EV_WDS_BEGIN	30 days
Windows Desktop Sharing: Stopped	7716	KLUSRLOG_EV_WDS_END	30 days
Third-party software update has been installed successfully	7694	KLNAG_EV_3P_PATCH_INSTALLED_SUCCESSFULLY	30 days
Third-party software update installation has started	7695	KLNAG_EV_3P_PATCH_INSTALL_STARTING	30 days
KSN Proxy has started. KSN availability check has completed successfully	7719	KSNPROXY_STARTED_CON_CHK_OK	30 days
KSN Proxy has stopped	7720	KSNPROXY_STOPPED	30 days

Event type display name	Event type	Default storage term
Failed to request the list of profile	PROFILELIST_COMMAND_FAILED	30 days
Failed to install the profile	INSTALLPROFILE_COMMAND_FAILED	30 days
Failed to remove the profile	REMOVEPROFILE_COMMAND_FAILED	30 days
Failed to request the list of provisioning profiles	PROVISIONINGPROFILELIST_COMMAND_FAILED	30 days
Failed to install provisioning profile	INSTALLPROVISIONINGPROFILE_COMMAND_FAILED	30 days
Failed to remove the provisioning profile	REMOVEPROVISIONINGPROFILE_COMMAND_FAILED	30 days
Failed to request the list of digital certificates	CERTIFICATELIST_COMMAND_FAILED	30 days
Failed to request the list of installed applications	INSTALLEDAPPLICATIONLIST_COMMAND_FAILED	30 days
Failed to request general information about the mobile device	DEVICEINFORMATION_COMMAND_FAILED	30 days
Failed to request security information	SECURITYINFO_COMMAND_FAILED	30 days
Failed to lock the mobile device	DEVICELOCK_COMMAND_FAILED	30 days
Failed to reset the password	CLEARPASSCODE_COMMAND_FAILED	30 days
Failed to wipe data from the mobile device	ERASEDEVICE_COMMAND_FAILED	30 days
Failed to install the app	INSTALLAPPLICATION_COMMAND_FAILED	30 days
Failed to set the redemption code for the app	APPLYREDEMPTIONCODE_COMMAND_FAILED	30 days
Failed to request the list of managed apps	MANAGEDAPPLICATIONLIST_COMMAND_FAILED	30 days
Failed to remove the managed app	REMOVEAPPLICATION_COMMAND_FAILED	30 days
Roaming settings have been rejected	SETROAMINGSETTINGS_COMMAND_FAILED	30 days
Error has occurred in the app operation	PRODUCT_FAILURE	30 days
Command result contains invalid data	MALFORMED_COMMAND	30 days
Failed to send the push notification	SEND_PUSH_NOTIFICATION_FAILED	30 days
Failed to send the command	SEND_COMMAND_FAILED	30 days
Device not found	DEVICE_NOT_FOUND	30 days

Event type display name	Event type	Default storage term
Attempt to connect a locked mobile device has been detected	INACTICE_DEVICE_TRY_CONNECTED	30 days
Profile has been removed	MDM_PROFILE_WAS_REMOVED	30 days
Attempt to re-use a client certificate has been detected	CLIENT_CERT_ALREADY_IN_USE	30 days
Inactive device has been detected	FOUND_INACTIVE_DEVICE	30 days
Redemption code is required	NEED_REDEMPTION_CODE	30 days
Profile has been included in a policy removed from the device	UMDM_PROFILE_WAS_REMOVED	30 days

Event type display name	Event type	Default storage term
New mobile device has been connected	NEW_DEVICE_CONNECTED	30 days
List of profiles has been successfully requested	PROFILELIST_COMMAND_SUCCESSFULL	30 days
Profile has been successfully installed	INSTALLPROFILE_COMMAND_SUCCESSFULL	30 days
Profile has been successfully removed	REMOVEPROFILE_COMMAND_SUCCESSFULL	30 days
List of provisioning profiles has been successfully requested	PROVISIONINGPROFILELIST_COMMAND_SUCCESSFULL	30 days
Provisioning profile has been successfully installed	INSTALLPROVISIONINGPROFILE_COMMAND_SUCCESSFULL	30 days
Provisioning profile has been successfully removed	REMOVEPROVISIONINGPROFILE_COMMAND_SUCCESSFULL	30 days
List of digital certificates has been successfully requested	CERTIFICATELIST_COMMAND_SUCCESSFULL	30 days
List of installed applications has been successfully requested	INSTALLEDAPPLICATIONLIST_COMMAND_SUCCESSFULL	30 days
General information about the mobile device has been successfully requested	DEVICEINFORMATION_COMMAND_SUCCESSFULL	30 days
Security information has been successfully requested	SECURITYINFO_COMMAND_SUCCESSFULL	30 days
Mobile device has been successfully locked	DEVICELOCK_COMMAND_SUCCESSFULL	30 days
The password has been successfully reset	CLEARPASSCODE_COMMAND_SUCCESSFULL	30 days
Data has been wiped from the mobile device	ERASEDEVICE_COMMAND_SUCCESSFULL	30 days
App has been successfully installed	INSTALLAPPLICATION_COMMAND_SUCCESSFULL	30 days
Redemption code has been successfully set for the app	APPLYREDEMPTIONCODE_COMMAND_SUCCESSFULL	30 days
The list of managed apps has been successfully requested	MANAGEDAPPLICATIONLIST_COMMAND_SUCCESSFULL	30 days
Managed app has been removed successfully	REMOVEAPPLICATION_COMMAND_SUCCESSFULL	30 days
Roaming settings have been successfully applied	SETROAMINGSETTINGS_COMMAND_SUCCESSFUL	30 days

Event type display name	Event type	Default storage term
Failed to wipe data from the mobile device	WIPE_FAILED	30 days
Cannot delete information about mobile device connection to mailbox	DEVICE_REMOVE_FAILED	30 days
Failed to apply the ActiveSync policy to the mailbox	POLICY_APPLY_FAILED	30 days
Application operation error	PRODUCT_FAILURE	30 days
Failed to modify the state of ActiveSync functionality	CHANGE_ACTIVE_SYNC_STATE_FAILED	30 days

Event type display name	Event type	Default storage term
New mobile device has connected	NEW_DEVICE_CONNECTED	30 days
Data has been wiped from the mobile device	WIPE_SUCCESSFULL	30 days

Contents

Event types

Data structure of event type description

Administration Server events

Administration Server critical events

Administration Server functional failure events

Administration Server warning events

Administration Server informational events

Network Agent events

Network Agent functional failure events

Network Agent warning events

Network Agent informational events

iOS MDM Server events

iOS MDM Server functional failure events

iOS MDM Server warning events

iOS MDM Server informational events

Exchange Mobile Device Server events

Exchange Mobile Device Server functional failure events

Exchange Mobile Device Server informational events