Return
-
Title
Is it possible to get a list of potential Syslog events / alerts and the Syslog fields that are sent? -
Description
Is it possible to get a list of potential Syslog events / alerts and the Syslog fields that are sent? -
Resolution
Safeguard transmits Syslog in CEF format. The below table describes the fields:
Field Description Example CEF:0 CEF header and version
0 Product Vendor OneIdentity Product Safeguard Product Version 2.11.0.11444 Event Name Name of the reported event. For a more detailed
description of an event see table 1PolicyAccountUpdated Severity A value that indicates the serverity of the event.
1=Information, 5= Warning, 10=Error1 cs1-6 Custom string 1 - 6
Karl cs1-6Label The name label for field cs1-6.
For a more detailed description of an label see table 2.EventUserDisplayName cn1-6 Custom number 1 - 6
5 cn1-6Label The name label for field cn1-6.
For a more detailed description of an label see table 2EventUserId msg A message giving more details on the event.
Table 1: The 387 potential Syslog events from 2.11 with description:Name Description A2AServiceDisabled Application to application service was disabled A2AServiceEnabled Application to application service was enabled AccessPolicyCreated An access policy has been created AccessPolicyDeleted A policy has been deleted AccessPolicyUpdated An access policy has been updated AccessRequestAcknowledged An access request activity has been acknowledged AccessRequestApprovalReceived An approval has been received for an access request AccessRequestApproved An access request has been approved AccessRequestAutoApproved An access request has been automatically approved AccessRequestAvailable A requested password is now available AccessRequestBrokerUpdated The access request broker has been updated AccessRequestCancelled An access request has been cancelled AccessRequestCheckedIn An access request has been checked in AccessRequestClosed An access request has been closed AccessRequestCreated An access request has been created AccessRequestDenied An access request has been denied AccessRequestExpired An access request has expired AccessRequestPasswordResetByPassed An access request subsequent check out is available as password reset was by-passed AccessRequestPendingAccountRestored An access request is pending the account to be restored AccessRequestPendingApproval An access request is pending approval AccessRequestRestricted The password availability for an access request has been restricted due to policy time restrictions AccessRequestReviewComplete A password release review requirement has been satisfied AccessRequestReviewed An access request has been reviewed AccessRequestRevoked An access request approval has been revoked AccessRequestSessionAuthenticated Access request session authenticated AccessRequestSessionAuthorized Access request session authorized AccessRequestSessionCommand Access request session command detected AccessRequestSessionConnected Access request session connected AccessRequestSessionFailure Access request session failure AccessRequestSessionInitialized A session has been initialized for an access request AccessRequestSessionLog A session log has been generated for an access request AccessRequestSessionPasswordCheckedOut Access request session checked out password AccessRequestSessionPlaybackInitialized Access request session playback initialized AccessRequestSessionTerminated Access request session authenticated AccountDiscoveryFailed Account discovery on a system failed AccountDiscoveryScheduleCreated An account discovery schedule was created AccountDiscoveryScheduleDeleted An account discovery schedule was deleted AccountDiscoveryScheduleUpdated An account discovery schedule was updated AccountDiscoveryStarted Account discovery on a system was started AccountDiscoverySucceeded Account discovery on a system succeeded AccountGroupCreated An account group has been created AccountGroupDeleted An account group has been deleted AccountGroupMembershipUpdated The membership of an account group has been updated AccountGroupUpdated An account group has been updated AccountWasRestored Account was restored AccountWasSuspended Account was suspended ActivatePrimaryAppliance The primary appliance has been activated ApplianceBackupCompleted A backup operation has completed ApplianceBackupDeleted A backup was deleted ApplianceBackupFailed A backup operation has failed ApplianceBackupStarted A new backup operation has started ApplianceBackupUploaded A backup has been uploaded ApplianceHealthy The appliance is healthy ApplianceRestarted The appliance has restarted ApplianceRestoreCompleted A backup restore operation has completed ApplianceRestoreFailed A backup restore operation has failed ApplianceRestoreStarted A backup restore operation has started ApplianceSick Appliance is sick ApplianceStateChanged Appliance state changed ApplianceUpdated Appliance information has been updated ApprovalAnywhereRegistrationFailed Failed to register user for approval anywhere for access request. ApprovalAnywhereUpdated Approval Anywhere configuration updated ApprovalAnywhereUserAdded A user was enrolled for Approval Anywhere ApprovalAnywhereUserRemoved A user was unenrolled from Approval Anywhere ApprovalEscalation An access request has been pending approval for too long ArchiveServerCreated An archive server has been created ArchiveServerDeleted An archive server has been deleted ArchiveServerSshHostKeyAdded An SSH key was added to an archive server ArchiveServerSshHostKeyRemoved An SSH key was removed from an archive server ArchiveServerSshHostKeyUpdated An SSH key was updated on an archive server ArchiveServerUpdated An archive server has been updated ArchiveTaskFailed An archive task failed ArchiveTaskStarted An archive task started ArchiveTaskSucceeded An archive task succeeded AssetAccountCreated An asset account has been created AssetAccountDeleted A asset account has been deleted AssetAccountDisabled An asset account has been disabled AssetAccountEnabled An asset account has been enabled AssetAccountPasswordUpdated An asset account password has been updated AssetAccountTagUpdated An asset account relationship to a partition tag has been updated AssetAccountUpdated A asset account has been updated AssetCreated An asset has been created AssetDeleted An asset has been deleted AssetDependencyUpdated The dependent directory accounts of an asset have been updated AssetDisabled An asset has been disabled AssetDiscoveryFailed Asset discovery failed AssetDiscoveryJobCreated An asset discovery job was created AssetDiscoveryJobDeleted An asset discovery job was deleted AssetDiscoveryJobUpdated An asset discovery job was updated AssetDiscoveryStarted Asset discovery started AssetDiscoverySucceeded Asset discovery succeeded AssetEnabled An asset has been enabled AssetGroupCreated An asset group has been created AssetGroupDeleted An asset group has been deleted AssetGroupMembershipUpdated The membership of an asset group has been updated AssetGroupUpdated An asset group has been updated AssetPartitionCreated An asset partition has been created AssetPartitionDeleted An asset partition has been deleted AssetPartitionOwnersUpdated An asset partition's list of owners has been updated AssetPartitionUpdated An asset partition has been updated AssetPasswordHistoryReleased The historical passwords of an asset account have been released AssetSshHostKeyAdded An SSH key was added to an asset AssetSshHostKeyRemoved An SSH key was removed from an asset AssetSshHostKeyUpdated An SSH key was updated on an asset AssetTagUpdated An asset relationship to a partition tag has been updated AssetUpdated An asset has been updated AuditLogPurged Audit log has been purged AuditLogRetentionUpdated Audit log retention settings have been updated AuditLogSigningCertificateUpdated The audit log signing certificate has been updated AuditLogStreamServiceUpdated The audit log stream service has been updated AutomationAgentDisabled An automation agent was disabled AutomationAgentEnabled An automation agent was enabled AutomationAgentRescheduled An automation agent was updated BmcAdminPasswordUpdated The BMC administrator password has been updated. BmcConfigurationUpdated The BMC network configuration has been updated. ClusterAbandoned The appliance left the cluster and is now standalone ClusterFailoverCompleted Replica promotion has completed ClusterFailoverStarted A replica is being promoted to primary ClusterIsolateCompleted The appliance isolation from the cluster has completed ClusterIsolateStarted The appliance isolation from the cluster has started ClusterMemberChanged The cluster member was changed ClusterPatchCompleted A cluster patch has completed. ClusterPatchStarted A cluster patch has been started. ClusterPrimaryQuorumLost The cluster primary appliance has lost connection to the majority of the cluster members ClusterPrimaryQuorumRestored The cluster primary appliance has restored connection to the majority of the cluster members ClusterReintegrateCompleted The appliance reintegration back into the cluster has completed ClusterReintegrateStarted The appliance reintegration back into the cluster has started ClusterReplicaConnected The replica has reconnected with the cluster primary ClusterReplicaDisconnected The replica has become disconnected from the cluster primary and a minority of replica(s) ClusterReplicaEnrollmentCompleted Replica enrollment has completed ClusterReplicaEnrollmentStarted An appliance is being enrolled as a replica ClusterReplicaQuorumLost The replica has lost connection to the majority of cluster members but is still connected to the cluster primary ClusterReplicaQuorumRestored The replica has restored connection to the majority of cluster members ClusterReplicaRemovalCompleted Replica removal has completed ClusterReplicaRemovalStarted A replica is being removed from the cluster ClusterResetCompleted The cluster has been reconfigured ClusterResetStarted The cluster is being reconfigured CredentialReleasedToApplication A credential has been released to an application DailyMessageUpdated The message of the day has been updated DependentAssetUpdateFailed A dependent asset update on an account failed DependentAssetUpdateStarted A dependent system update was started DependentAssetUpdateSucceeded A dependent asset update on an account succeeded DiagnosticPackageDeleted The diagnostic package was deleted DiagnosticPackageExecutionCanceled Execution of diagnostic package was canceled. DiagnosticPackageExecutionFailed A diagnostic package finished execution with errors DiagnosticPackageExecutionStarted A diagnostic package started execution DiagnosticPackageExecutionSucceeded A diagnostic package finished execution successfully DiagnosticPackageStageFailed A diagnostic package failed to stage DiagnosticPackageStageSucceeded A diagnostic package was successfully staged DirectoryAssetDeleteSyncFailed Directory asset delete synchronization failed DirectoryAssetDeleteSyncSucceeded Directory asset delete synchronization succeeded DirectoryAssetSyncFailed Directory asset synchronization failed DirectoryAssetSyncSucceeded Directory asset synchronization succeeded DirectoryGroupCreated A directory group has been created DirectoryGroupDeleted A directory group has been deleted DirectoryGroupMembershipUpdated The membership of a directory group has been updated DirectoryGroupSyncComplete The background processing of a directory user group synchronization of members has completed. Errors may be logged in the audit log. DirectoryGroupUpdated A user group has been updated DirectoryProviderDeleteSyncFailed Directory provider delete synchronization failed DirectoryProviderDeleteSyncSucceeded Directory provider delete synchronization succeeded DirectoryProviderSyncFailed Directory provider synchronization failed DirectoryProviderSyncSucceeded Directory provider synchronization succeeded DiscoverSshHostKeyFailed Failed to discover SSH host key on an asset DiscoverSshHostKeyStarted Started to discover SSH host key on an asset DiscoverSshHostKeySucceeded Successfully discovered SSH host key on an asset DiscoveredAccountUpdated The discovered properties of an account have been updated DiscoveredAssetUpdated The discovered properties of an asset have been updated DiskUsageWarning Disk usage has reached a critical level DnsSuffixesUpdated DNS suffixes have been updated EmailClientConfigUpdated The email client configuration has been updated EmailNotificationFailed An email notification failed to be sent EmailTemplateCreated An email template was created EmailTemplateDeleted An email template was deleted EmailTemplateUpdated An email template was updated EmergencyAccessGranted An access request has requested and been granted emergency access EventSubscriberCreated An event subscriber has been created EventSubscriberDeleted An event subscriber has been deleted EventSubscriberNotificationDisabled An event subscriber notification has been disabled EventSubscriberNotificationEnabled An event subscriber notification has been enabled EventSubscriberUpdated An event subscriber has been updated EventSubscriptionsUpdated An event subscriber's list of subscribed events has been updated FactoryResetAppliance The appliance was factory reset Fido2AuthenticatorDeleted A user's FIDO2 authenticator was deleted Fido2AuthenticatorUpdated A user's FIDO2 authenticator was updated IdentityProviderCreated An identity provider has been created IdentityProviderDeleted An identity provider has been deleted IdentityProviderUpdated An identity provider has been updated InitialSetupCompleted The appliance has completed initial setup and now has an appliance id. LicenseDeleted A license has been deleted LicenseExpired An installed license has expired LicenseExpiringSoon An installed license is due to expire soon LicenseStaged A license was updated LicenseUpdated An installed license has been updated LinkedAccountUserRelationshipAdded An account was linked to a user LinkedAccountUserRelationshipRemoved An account was unlinked from a user LoginMessageUpdated Login message has been updated MaintenanceModeFailed The current maintenance mode failed MaintenanceModeStarting The appliance is switching to Maintenance Mode MaintenanceScheduleUpdated A maintenance schedule has been updated ManagedNetworkCreated A managed network has been created ManagedNetworkDeleted A managed network has been deleted ManagedNetworkMembersUpdated The cluster members assigned to a managed network have been updated. ManagedNetworkUpdated A managed network has been updated NetworkDiagnosticsTestRun A network diagnostics test was run on the Appliance NetworkInterfaceUpdated A network interface has been updated NtpClientDisabled The NTP client has been disabled NtpClientEnabled The NTP client has been enabled NtpClientResetToLocalClock The NTP client has been reset to maintain time by using the local clock NtpClientSynced The NTP client has been synced NtpDriftDetected NTP time drift detected NtpErrorDetected NTP error detected OperatingSystemLicenseFailed The virtual appliance operating system is no longer licensed. OperationalModeAppliance The appliance was returned to operational mode PartitionProfileAccountPasswordRuleCreated An asset partition profile account password rule was created PartitionProfileAccountPasswordRuleDeleted An asset partition profile account password rule was deleted PartitionProfileAccountPasswordRuleUpdated An asset partition profile account password rule was updated PartitionProfileChangeScheduleCreated An asset partition profile change schedule was created PartitionProfileChangeScheduleDeleted An asset partition profile change schedule was deleted PartitionProfileChangeScheduleUpdated An asset partition profile change schedule was updated PartitionProfileCheckScheduleCreated An asset partition profile check schedule was created PartitionProfileCheckScheduleDeleted An asset partition profile check schedule was deleted PartitionProfileCheckScheduleUpdated An asset partition profile check schedule was updated PartitionProfileCreated An asset partition profile was created PartitionProfileDeleted An asset partition profile was deleted PartitionProfileSyncGroupCreated Partition profile sync group has been created PartitionProfileSyncGroupDeleted Partition profile sync group has been deleted PartitionProfileSyncGroupDisabled Partition profile sync group has been disabled PartitionProfileSyncGroupEnabled Partition profile sync group has been enabled PartitionProfileSyncGroupMembershipUpdated Partition profile sync group membership has been updated PartitionProfileSyncGroupUpdated Partition profile sync group has been updated PartitionProfileUpdated An asset partition profile was updated PartitionTagCreated A tag has been created PartitionTagDeleted A tag has been deleted PartitionTagUpdated A tag has been updated PasswordChangeFailed A password change on an account failed PasswordChangeStarted A password change on an account was started PasswordChangeSucceeded A password change on an account succeeded PasswordCheckFailed A password check on an account has failed PasswordCheckMismatch A password check on an account found a mismatched password PasswordCheckStarted A password check on an account was started PasswordCheckSucceeded A password check on an account succeeded PasswordReleased An account password has been released PasswordResetNeeded A password release has expired and the password must be manually reset PasswordWasReset An account password for an access request has been reset PatchCompleted A patch operation has completed PatchDistributionCancelRequested Cancellation of patch distribution has been requested PatchDistributionCanceled Patch distribution has been canceled PatchDistributionCompleted Patch distribution to replica appliances has completed PatchDistributionStarted Patch distributed to replica appliances has started PatchFailed A patch operation has failed PatchStaged A patch was staged PatchStarted A patch operation has started PatchUnstaged A staged patch was removed PlatformCreated A platform has been created PlatformDeleted A platform has been deleted PlatformScriptDeleted A platform script was deleted PlatformScriptUpdated A platform script was updated PlatformUpdated A platform has been updated PolicyAccountCreated An policy account has been created PolicyAccountDeleted A policy account has been deleted PolicyAccountDisabled A policy account has been disabled PolicyAccountEnabled A policy account has been enabled PolicyAccountUpdated A policy account has been updated PolicyAssetCreated An policy asset has been created PolicyAssetDeleted A policy asset has been deleted PolicyAssetDisabled A policy asset has been disabled PolicyAssetEnabled A policy asset has been enabled PolicyAssetUpdated A policy asset has been updated PolicyExpirationWarning A policy is about to expire PolicyExpired A policy has expired PolicyInvalid A policy is invalid PolicyPrioritiesUpdated Policy priorities have been updated QuarantineAppliance The appliance was placed in Quarantine mode RaidErrorDetected RAID error detected ReasonCodeCreated A reason code has been created ReasonCodeDeleted A reason code has been deleted ReasonCodeUpdated A reason code has been updated RebootAppliance The appliance was rebooted RegistrationCreated A registration has been created RegistrationDeleted A registration has been deleted RegistrationUpdated A registration has been updated RelayProxyConfigCreated Relay proxy configuration is created RelayProxyConfigDeleted Relay proxy configuration is deleted RelayProxyConfigUpdated Relay proxy configuration is updated RestoreAccountFailed Restore account on a system failed RestoreAccountStarted Restore account on a system started RestoreAccountSucceeded Restore account on a system succeeded ReviewEscalation An access request has been pending review for too long ReviewNeeded An access request has expired and requires review RoleCreated A role has been created RoleDeleted A role has been deleted RoleExpirationWarning A role is about to expire RoleExpired A role has expired RoleMembershipUpdated A role's membership has been updated RolePrioritiesUpdated Role priorities have been updated RoleUpdated A role has been updated ScheduledAuditLogReportCreated A scheduled audit log report was created ScheduledAuditLogReportDeleted A scheduled audit log report was deleted ScheduledAuditLogReportUpdated A scheduled audit log report was updated ScheduledPlatformTasksCompleted Scheduled platform tasks have completed SchedulerJobFailed A scheduler job failed SchedulerJobSucceeded A scheduler job succeeded ServerCertificateAdded A server certificate was installed ServerCertificateRemoved A server certificate was removed ServerCertificateSignatureRequestCreated A web server certificate signing request (CSR) has been created ServerCertificateSignatureRequestDeleted A web server certificate signing request (CSR) has been deleted ServiceDiscoveryFailed Service discovery on a system failed ServiceDiscoveryStarted Service discovery on a system was started ServiceDiscoverySucceeded Service discovery on a system succeeded ServicesConfigUpdated Services configuration has been updated SessionArchiveConfigUpdated Session archive configuration updated SessionBannerUpdated Session banner updated SessionCertificateUpdated A session certificate has been updated SessionModuleActionPerformed Session module action performed SessionModuleConfigUpdated Session module configuration updated SessionModuleConnectionCreated A session module connection has been created SessionModuleConnectionDeleted A session module connection has been deleted SessionModuleConnectionUpdated A session module connection has been updated SessionModuleRestoreFailed Session module restore failed. A manual sessions module reset will be required SessionRecordingRemoved A session recording was removed from the cluster SessionSshAlgorithmsUpdated Session SSH algorithms have been updated SessionSshHostKeyUpdated Session SSH server host key updated SettingUpdated A system core setting was updated ShutdownAppliance The appliance was shut down SshHostKeyMismatch An SSH connection found a mismatched SSH host key SshKeyChangeFailed An SSH key change on an account failed SshKeyChangeStarted An SSH key change on an account was started SshKeyChangeSucceeded An SSH key change on an account succeeded SshKeyCreated An SSH key has been created SshKeyDeleted An SSH key has been deleted SshKeyInstallFailed An SSH key install on an account failed SshKeyInstallStarted An SSH key install on an account was started SshKeyInstallSucceeded An SSH key install on an account succeeded SshKeyUpdated An SSH key has been updated SslCertificateUpdated The web SSL certificate has been updated SslProtocolsUpdated Available SSL protocols were updated for this appliance. StarlingSubscriptionCreated A Starling subscription has been created StarlingSubscriptionDeleted A Starling subscription has been deleted StarlingSubscriptionUpdated A Starling subscription has been updated SupportBundleCreated A support bundle has been created SuspendAccountFailed Suspend account on a system failed SuspendAccountStarted Suspend account on a system started SuspendAccountSucceeded Suspend account on a system succeeded SyncAccountsFailed Failed to synchronize account credentials SyncAccountsStarted Started to synchronize account credentials SyncAccountsSucceeded Successfully synchronized account credentials SynchronizingAuditLogsCompleted The appliance(s) have completed synchronizing audit logs. SynchronizingAuditLogsStarted The appliance(s) have started synchronizing audit logs. SynchronizingDataCompleted The appliance(s) have completed synchronizing configuration data. SynchronizingDataStarted The appliance(s) have started synchronizing configuration data. SyslogClientConfigUpdated The email client configuration has been updated SystemTimeUpdated The system time has been updated Test This is a test event only used to validate event notification configurations TestAssetDiscoveryFailed Asset discovery test failed TestAssetDiscoveryStarted Asset discovery test started TestAssetDiscoverySucceeded Asset discovery test succeeded TestConnectionFailed A test connection on an asset failed TestConnectionStarted A test connection on an asset was started TestConnectionSucceeded A test connection on an asset succeeded TicketSystemCreated A ticket system has been created TicketSystemDeleted A ticket system has been deleted TicketSystemUpdated A ticket system has been updated TrustedCertificateAdded A trusted certificate has been added TrustedCertificateRemoved A trusted certificate has been removed UserAuthenticated A user has been successfully authenticated UserAuthenticationFailed A user authentication attempt failed UserCreated A user has been created UserDeleted A user has been deleted UserGroupCreated A user group has been created UserGroupDeleted A user group has been deleted UserGroupMembershipUpdated The membership of a user group has been updated UserGroupUpdated A user group has been updated UserLinkedAccountRelationshipAdded A linked account has been assigned to a user UserLinkedAccountRelationshipRemoved A linked account has been unassigned from a user UserLockedOut A user was locked out due to authentication failures UserPasswordRuleUpdated A password rule has been updated UserPasswordUpdated A user password has been updated UserPhotoDeleted A user's photo has been deleted UserPhotoUpdated A user's photo has been updated UserPreferenceDeleted A user preference was deleted UserPreferenceUpdated A user preference was updated UserRequestFavoriteCreated A user request favorite has been created UserRequestFavoriteDeleted A user request favorite has been deleted UserRequestFavoriteMembershipUpdated The membership of a user request favorite has been updated UserRequestFavoriteUpdated A user request favorite has been updated UserUnlocked A user who was locked out has been unlocked UserUpdated A user has been updated
Table 2: Description of potential custom stringsName Description AccessRequestId ID of the access request AccessRequestType Access request type AccountGroupId ID number of the account group AccountGroupName Name of the account group AccountId ID number of the account AccountName Name of the account ActionUserIds IDs of users that can take action on this notification AddedSuffixes DNS suffixes added Address Daily message content address AdminAssigned Tag is known to have been added or removed by an administrator ApplianceId Appliance unique ID ApplianceIdentity Unique appliance identifier ApplianceName Display name of the appliance AppName Name of the registered application ApprovalAnywhereEnabled Approval Anywhere enabled ArchiveServerId Archive server ID ArchiveServerName Name of archive server ArchiveTaskType Type of archive task AssetDiscoveryEnabled Asset discovery enabled AssetDiscoveryJobId Asset discovery job ID AssetDiscoveryJobName Name of the asset discovery job AssetDiscoveryJobType Asset discovery type AssetDiscoveryReason Asset discovery failure reason AssetDiscoveryTaskId Asset discovery task ID AssetGroupId ID number of the asset group AssetGroupName Name of the asset group AssetId ID number of the asset AssetName Name of the asset AssetPartitionId ID number of the asset partition AssetPartitionName Name of the asset partition AssociatedApplianceId Associated archive server appliance AvailableMb Available disk space in megabytes BackupId ID number of the backup operation BackupPortNumber Backup syslog server port BackupServerAddress Backup syslog server address BackupVersion Version of the appliance when the backup was taken. Banner Banner BodyTemplate Template for the email body Category Setting category ChangePasswordTasks Change password tasks CheckPasswordTasks Check password tasks ClusterMemberIds Unique identifiers of assigned cluster members ClusterPatchStatus Cluster patch status Comment Request action comment CredentialId Credential id (unique to a user registration) of a FIDO2 authenticator CredentialType The type of credential released CurrentState Success of failover CurrentThreadLimit Limit of how many agent threads are allowed DateLastAuthenticated Date the FIDO2 authenticator was last used to authenticate the user DateRegistered Date when the FIDO2 authenticator was registered DaysRemaining The number of days remaining on a time based license DaysToRetainLogs Days to retain audit logs DebugLoggingEnabled Debug logging enabled Description Description DirectoryId ID number of the directory DirectoryName Name of the directory DirectorySyncEnabled Directory sync enabled DiscoverAccountsTasks Discover accounts tasks DiscoverServicesTasks Discover services tasks DnsServers DNS servers DomainName Name of the domain Duration Duration DurationInMinutes Duration of the request (in minutes) EmailAddress Email address Enabled State of the access request broker or audit log stream service EnableLinkAutoNegotiation Enable link auto-negotiation EnrollmentOperationId ID of the replica enrollment operation completed by this event ErrorMessage Failover error EventDescription General description of the event EventName Name of the event EventSubscriberId ID number of the event subscriber EventSubscriberType Type of the event subscriber EventTimestamp Date/time the event occurred (in UTC) EventUserDisplayName Display name of user that performed action EventUserDomainName Domain name of user that performed action EventUserId Unique ID of user that performed action Expires The date the license expired ExpiresAt Expiration date / time of policy Facility Syslog logging facility FailedReplicaList Failed replicas FileName File name Fingerprint Fingerprint of the SSH host key Greeting Greeting HealthMessage Message reflecting that the appliance is healthy Id ID number IdentityProviderId ID number of the identity provider IdentityProviderName Name of the identity provider IdentityProviderType Type of the identity provider InstallationError Patch installation error IntervalDurationMinutes How frequently the agent will run in minutes Ipv4Address IPv4 address of the network interface Ipv4Gateway IPv4 gateway Ipv4StaticRoutes IPv4 static routes Ipv6Address IPv6 address of the network interface Ipv6Gateway IPv6 gateway Ipv6StaticRoutes IPv6 static routes Ipv6SubnetPrefixLength IPv6 subnet prefix length Issuer Certificate issuer JobException Exception thrown by this job JobExitCode Exit code of the scheduler job run JobMessage Message from scheduler job JobStartTime Time the scheduler job started JobStopTime Time the scheduler job completed JobThreadCount Number of threads assigned to the job Key License key of the license that has expired LinkDuplex Link duplex LinkSpeedMbps Link speed (Mbps) LogDate Event date LogIndex Event index LogLevel Event level LogMessage Event message MaintenanceType Type of maintenance schedule that was updated ManagedNetworkId ID number of the managed network ManagedNetworkName Name of the managed network Message Message Name Name NetworkAddress Network address of archive or replica server NetworkInterface Network interface NewPrimaryIp New primary Ip NewPrimaryName New primary name NewReplicaList New replicas NewThumbprint New session certificate thumbprint NewTime New system time (in UTC) NewValue Setting updated value NodeId Name of the session module connection NotStarted Errors starting tasks OfflineWorkflowMode Offline Workflow mode OldPrimaryIp Old primary Ip OldPrimaryName Old primary name OldReplicaList Old replicas OldThumbprint Old session certificate thumbprint OldTime Old system time (in UTC) OldValue Setting old value PasswordChangeEnabled Password change enabled PasswordCheckEnabled Password check enabled PasswordRequestsEnabled Password requests enabled PasswordRuleId ID of account password rule PasswordRuleName Name of the password rule PatchVersion Version of the patch PlatformId ID of the platform PlatformName Name of the platform PolicyId ID of the access policy PolicyIdsOrdered Semicolon separated list of policy ids in ascending order of priority PolicyName Name of the access policy PortNumber Email server port PreviousState Failover error PrimaryPortNumber Primary syslog server port PrimaryServer Primary server of the NTP client PrimaryServerAddress Primary syslog server address ProfileId ID of the profile ProfileName Name of the profile ProxyPort Relay proxy server port ProxyServerUri Relay proxy server URI PurgedDate Logs before this date have been purged Reason Reason ReasonCode Reason code ReasonCodeId ID number of the reason code ReasonCodeName Name of the reason code RecordingFileName Name of the recording file RegistrationId Id of the registered application RemovedApplianceId ID of the removed appliance RemovedSuffixes DNS suffixes removed RemovingApplianceId ID of the appliance being removed RepeatDayOfMonth Which day of the month to run maintenance RepeatDayOfWeek Which day of week to run maintenance RepeatDaysOfWeek Which days of the week to run maintenance RepeatInterval How frequently to run maintenance RepeatMonthlyScheduleType Type of monthly schedule RepeatWeekOfMonth Which week of the month to run maintenance ReplicaApplianceId Appliance ID of replica ReplicaList Appliance ID of replica appliances ReplicaNetworkAddress Network address of the replica ReplyToEmail Reply to email address used by this template Requester Name of the requesting user RequesterId ID number of the requesting user RequesterUsername Requester Username RequestId ID number of the access request RequiredDate Date/time the request should become active RequireTlsFlag Email server require TLS flag RestoreAccountTasks Restore account tasks Results Result of the network diagnostics test RoleId ID of the role RoleIdsOrdered Semicolon separated list of role ids in ascending order of priority RoleName Name of the role RunningVersion Version of the appliance when the restore was started. SchedulerTriggerId Unique identifier of the scheduler job ScheduleType How frequently to check for audit logs to archive / type of schedule SecondaryServer Seconday server of the NTP client SecureSsl Whether appliance is using most secure SSL protocols SenderEmail Email reply to sender address ServerAddress SMTP server address ServiceAccountName Name of service account SessionCachedPercentUsed Percent of session cache used in megabytes SessionCacheUsedMb Session cache space used in megabytes SessionCertificateType Session certificate type SessionId ID of the access request session SessionModuleAction Session module action SessionModuleConnectionId Id of the session module connection SessionRequestsEnabled Session requests enabled SessionSpsNodeIpAddress Sessions SPS node IP Address Sickness Cause of appliance sickness Size Size in bytes of the backup operation result SpsHostName Network address of the joined session module SpsNetworkAddress Network address of the joined session module SshHostKey Public SSH host key SshKeyChangePasswordTasks SSH key change tasks StarlingSubscriptionId ID number of the subscription StartHour Hour of the day StartMinute Minute of the hour StartTime Start time for batch of scheduled tasks Status Status of backup operation StoragePath Location where archives are stored Subject Certificate subject SubjectTemplate Template for the email subject Success Success of failover SuspendAccountTasks Suspend account tasks SyncAccountsTasks Sync accounts tasks SyncGroupId ID of the sync group SyncGroupName Name of the sync group SystemId ID number of the target system SystemName Name of the target system TagId ID number of the tag TagName Name of the tag TagPartitionId ID number of the parent partition TagPartitionName Name of the parent partition TaskId ID number of the task TemplateEventName Name representation of the event that will trigger an email TestType Type of network diagnostics test run Thumbprint Certificate thumbprint TicketNumber Ticket number TicketSystemId ID number of the ticket system TicketSystemName Name of the ticket system TicketSystemType Type of the ticket system TimeDifferenceMilliseconds Time difference in milliseconds between the appliance NTP client and its configured time source TimeSampleSeconds Duration of the time drift in seconds TimeZoneDisplayName Description of time zone TimeZoneId ID of time zone to calculate schedule in Title Title of the patch TotalMb Total disk space in megabytes TotalSessionCacheMb Total session cache space in megabytes TotalTasks Total tasks attempted TransferProtocolType Type of transfer protocol to use TriggerMisfired The scheduler job misfired TriggerVetoed The scheduler job was vetoed Type The type of the license UniqueId Unique ID of the archive file UpdateDependentAssetTasks Update dependent asset tasks UserGroupId ID number of the user group UserGroupName Name of the user group UserId ID number of the user UserIdentityProviderId ID number of the user's identity provider UserIdentityProviderName Name of the user's identity provider UserName Name of the user UserPrimaryAuthenticationProviderId ID number of the user's primary authentication provider UserPrimaryAuthenticationProviderName Name of the user's primary authentication provider UserRequestFavoriteId ID of the user Request Favorite UserRequestFavoriteName Name of the user request favorite Value Value of the preference -
Additional Information
The current name and description of Syslog events can be gathered from the Core Swagger API /service/core/v3/Events?filter=Syslogflag%20eq%20true&fields=name%2Cdescription