Virus outbreak

26 (for File Threat Protection)

GNRL_EV_VIRUS_OUTBREAK

Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period of time.

You can respond to the event in the following ways:

• Configure the threshold in the Administration Server properties.
• Create a stricter policy that will be activated, or create a task that will be run, at the occurrence of this event.

180 days

Virus outbreak

28 (for firewall)

GNRL_EV_VIRUS_OUTBREAK

Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period of time.

You can respond to the event in the following ways:

• Configure the threshold in the Administration Server properties.
• Create a stricter policy that will be activated, or create a task that will be run, at the occurrence of this event.

180 days

Device status is Critical

4113

KLSRV_HOST_STATUS_CRITICAL

Events of this type occur when a managed device is assigned the Critical status. You can configure the conditions under which the device status is changed to Critical.

180 days

Limited functionality mode

4130

KLSRV_EV_LICENSE_SRV_LIMITED_MODE

Events of this type occur when Kaspersky Security Center starts to operate with basic functionality, without Vulnerability and Patch Management and without Mobile Device Management features.

Following are causes of, and appropriate responses to, the event:

• License term has expired. Provide a license to use the full functionality mode of Kaspersky Security Center (add a valid activation code or a key file to Administration Server).
• Administration Server manages more devices than specified by the license limit. Move devices from the administration groups of an Administration Server to those of another Administration Server (if the license limit of the other Administration Server allows).

180 days

Certificate has expired

4132

KLSRV_CERTIFICATE_EXPIRED

Events of this type occur when the Administration Server certificate for Mobile Device Management expires.

You need to update the expired certificate.

You can configure automatic updates of certificates by selecting the Reissue certificate automatically if possible check box in the certificate issuance settings.

180 days

Limit of installations has been exceeded for one of the licensed applications groups

4126

KLSRV_INVLICPROD_EXCEDED

Administration Server generates events of this type periodically (every hour). Events of this type occur if in Kaspersky Security Center you manage license keys of third-party applications and if the number of installations has exceeded the limit set by the license key of the third-party application.

You can respond to the event in the following ways:

• Look through the managed devices list. Delete the third-party application from devices on which the application is not in use.
• Use a third-party license for more devices.

You can manage license keys of third-party applications using the functionality of licensed applications groups. A licensed applications group includes third-party applications that meet criteria set by you.

180 days

Failed to copy the updates to the specified folder

4123

KLSRV_UPD_REPL_FAIL

Events of this type occur when software updates are copied to an additional shared folder(s).

You can respond to the event in the following ways:

• Check whether the user account that is employed to gain access to the folder(s) has write permission.
• Check whether a user name and/or a password to the folder(s) changed.
• Check the internet connection, as it might be the cause of the event. Follow the instructions to update databases and software modules.

180 days

Shared folder is not available

4108

KLSRV_SHARED_FOLDER_UNAVAILABLE

Events of this type occur if the shared folder of Administration Server is not available.

You can respond to the event in the following ways:

• Check whether the Administration Server (where the shared folder is located) is turned on and available.
• Check whether a user name and/or a password to the folder is/are changed.
• Check the network connection.

180 days

No free space in the Administration Server database

4110

KLSRV_DATABASE_FULL

Events of this type occur when there is no free space in the Administration Server database.

Administration Server does not function when its database has reached its capacity and when further recording to the database is not possible.

Following are the causes of this event, depending on the DBMS that you use, and appropriate responses to the event:

• You use the SQL Server Express Edition DBMS:

  In the SQL Server Express documentation, review the database size limit for the version you use. Probably your Administration Server database has exceeded the database size limit.

  Limit the number of events to store in the Administration Server database.

  In the Administration Server database there are too many events sent by the Application Control component. You can change the settings of the Kaspersky Endpoint Security for Windows policy relating to Application Control event storage in the Administration Server database.

• You use a DBMS other than SQL Server Express Edition:

  Do not limit the number of events to store in the Administration Server database.

  Reduce the list of events to store in the Administration Server database.

  Review the information on DBMS selection.

180 days

License limit has been exceeded

4098

KLSRV_EV_LICENSE_CHECK_100_110

Once a day Kaspersky Security Center checks whether a licensing restriction is exceeded.

Events of this type occur when Administration Server detects that some licensing limits are exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license constitute 100% to 110% of the total number of units covered by the license.

Even when this event occurs, client devices are protected.

You can respond to the event in the following ways:

• Look through the managed devices list. Delete devices that are not in use.
• Provide a license for more devices (add a valid activation code or a key file to Administration Server).

Kaspersky Security Center determines the rules to generate events when a licensing restriction is exceeded.

90 days

Conflict of device names

4102

KLSRV_EVENT_HOSTS_CONFLICT

Events of this type occur when Administration Server considers two or more managed devices as a single device.

Most often this happens when a cloned hard drive was used for software deployment on managed devices and without switching the Network Agent to the dedicated disk cloning mode on a reference device.

To avoid this issue, switch Network Agent to the disk cloning mode on a reference device before cloning the hard drive of this device.

90 days

Limit of installations will soon be exceeded for one of the licensed applications groups

4127

KLSRV_INVLICPROD_FILLED

Events of this type occur when the number of installations for third-party applications included in a licensed applications group reaches 90% of the maximum allowed value specified in the license key properties.

You can respond to the event in the following ways:

• If the third-party application is not in use on some of the managed devices, delete the application from these devices.
• If you expect that the number of installations for the third-party application will exceed the allowed maximum in the near future, consider obtaining a third-party license for a greater number of devices in advance.

You can manage license keys of third-party applications using the functionality of licensed applications groups.

90 days

Certificate has been removed

4134

KLSRV_CERTIFICATE_REMOVED

Events of this type occur when an administrator removes any type of certificate (General, Mail, VPN) for Mobile Device Management.

After removing a certificate, mobile devices connected via this certificate will fail to connect to Administration Server.

This event might be helpful when investigating malfunctions associated with the management of mobile devices.

90 days

APNs certificate expires soon

4136

KLSRV_APN_CERTIFICATE_EXPIRES_SOON

Events of this type occur when there are fewer than 14 days left before the APNs certificate expires.

When the APNs certificate expires, you need to manually renew the APNs certificate and install it on an iOS MDM Server.

We recommend that you schedule the APNs certificate renewal in advance of the expiration date.

Not stored

HTTP error sending the FCM message to the FCM server

4139

KLSRV_GCM_HTTP_ERROR

Events of this type occur when Mobile Device Management is configured to use Google Firebase Cloud Messaging (FCM) for connecting managed mobile devices with the Android operating system and FCM Server reverts to the Administration Server a request with a HTTP code other than 200 (OK).

Following might be the causes and appropriate responses to the event:

• Problems on the FCM server side. Read the HTTP code in the details of the event description and respond accordingly. For more information on the HTTP codes received from FCM Server and related errors, please refer to the Google Firebase service documentation (see chapter "Downstream message error response codes").
• Problems on the proxy server side (if you use proxy server). Read the HTTP code in the details of the event and respond accordingly.

90 days

Little free space on the hard drive

4105

KLSRV_NO_SPACE_ON_VOLUMES

Events of this type occur when the hard drive of the device on which Administration Server is installed almost runs out of free space.

Free up disk space on the device.

90 days

Connection to the secondary Administration Server has been interrupted

4116

KLSRV_EV_SLAVE_SRV_DISCONNECTED

Events of this type occur when a connection to the secondary Administration Server is interrupted.

Read the Kaspersky Event Log on the device where the secondary Administration Server is installed and respond accordingly.

90 days

New updates for Kaspersky software modules have been registered

4141

KLSRV_SEAMLESS_UPDATE_REGISTERED

Events of this type occur when Administration Server registers new updates for the Kaspersky software installed on managed devices that require approval to be installed.

Approve or decline the updates by using Administration Console or using Kaspersky Security Center Web Console.

90 days

Events have been deleted from the database because the limit on the number of events was exceeded

4146

KLSRV_EVP_DB_TRUNCATED

Events of this type occur when old events have been deleted from the Administration Server database after the Administration Server database capacity is reached.

You can respond to the event in the following ways:

• Change the allowed maximum number of events to be stored in the Administration Server database
• Reduce the list of events to store in the Administration Server database

Not stored

New device has been detected

4100

KLSRV_EVENT_HOSTS_NEW_DETECTED

30 days

Device has been removed from the group: inactive on the network for a long time

4104

KLSRV_INVISIBLE_HOSTS_REMOVED

30 days

Files have been found to send to Kaspersky for analysis

4131

KLSRV_APS_FILE_APPEARED

30 days

Updates have been successfully copied to the specified folder

4122

KLSRV_UPD_REPL_OK

30 days

Connection to the primary Administration Server has been established

4117

KLSRV_EV_MASTER_SRV_CONNECTED

30 days

Audit: Connection to the Administration Server has been established

4147

KLAUD_EV_SERVERCONNECT

30 days

Audit: Object status has changed

4150

KLAUD_EV_TASK_STATE_CHANGED

30 days

For example, this event occurs when a task has failed with an error.

Audit: Connection to Administration Server has been terminated

4151

KLAUD_EV_SERVERDISCONNECT

30 days

Audit: User permissions have been modified

4153

KLAUD_EV_OBJECTACLMODIFIED

30 days