System events
To view system events, go to Events & Reports > Events.
To configure system events, go to the Administration > System Settings > System Events tab. On this tab you can set whether to record individual events and whether to forward them to a SIEM server. If you select Record, then the event is saved to the database. If you deselect Record, then the event won't appear under the Events & Reports tab (or anywhere in Deep Security Manager) and it won't be forwarded either.
Depending on whether it's a system configuration change or security incident, each log will appear in either the System Events sub-menu, or the sub-menu corresponding to the event's protection module, such as Anti-Malware Events.
These events sometimes also appear in the Status column on Computers.
| ID | Severity | Event | Description or Solution |
| 0 | Error | Unknown Error | |
| 100 | Info | Deep Security Manager Started | |
| 101 | Info | License Changed | |
| 102 | Info | Trend Micro Deep Security Customer Account Changed | |
| 103 | Warning | Check For Updates Failed | |
| 104 | Warning | Automatic Software Download Failed | |
| 105 | Warning | Scheduled Rule Update Download and Apply Failed | |
| 106 | Info | Scheduled Rule Update Downloaded and Applied | |
| 107 | Info | Rule Update Downloaded and Applied | |
| 108 | Info | Script Executed | |
| 109 | Error | Script Execution Failed | |
| 110 | Info | System Events Exported | |
| 111 | Info | Firewall Events Exported | |
| 112 | Info | Intrusion Prevention Events Exported | |
| 113 | Warning | Scheduled Rule Update Download Failed | |
| 114 | Info | Scheduled Rule Update Downloaded | |
| 115 | Info | Rule Update Downloaded | |
| 116 | Info | Rule Update Applied | |
| 117 | Info | Deep Security Manager Shutdown | |
| 118 | Warning | Deep Security Manager Offline | |
| 119 | Info | Deep Security Manager Back Online | |
| 120 | Error | Heartbeat Server Failed | The server within Deep Security Manager that listens for incoming agent heartbeats did not start. Check that the manager's incoming heartbeat port number is not in use by another application on the server. Once the port is free, the manager's heartbeat server should bind to it, and this error should be fixed. |
| 121 | Error | Scheduler Failed | |
| 122 | Error | Manager Message Thread Failed | An internal thread has failed. There is no resolution for this error. If it persists, please contact customer support. |
| 123 | Info | Deep Security Manager Forced Shutdown | |
| 124 | Info | Rule Update Deleted | |
| 130 | Info | Credentials Generated | |
| 131 | Warning | Credential Generation Failed | |
| 140 | Info | Discover Computers | |
| 141 | Warning | Discover Computers Failed | |
| 142 | Info | Discover Computers Requested | |
| 143 | Info | Discover Computers Canceled | |
| 150 | Info | System Settings Saved | |
| 151 | Info | Software Added | |
| 152 | Info | Software Deleted | |
| 153 | Info | Software Updated | |
| 154 | Info | Software Exported | |
| 155 | Info | Software Platforms Changed | |
| 156 | Error | Agent Installer Digital Signature Verification Failed |
'<agent>.zip' has been deleted because the digital signature verification failed. The failure indicates that the file may have been tampered with. Details: <detailed_message> Please contact Trend Micro support for more help. See Check digital signatures on software packages for details. |
| 160 | Info | Authentication Failed | |
| 161 | Info | Rule Update Exported | |
| 162 | Info | Log Inspection Events Exported | |
| 163 | Info | Anti-Malware Event Exported | |
| 164 | Info | Security Update Successful | |
| 165 | Error | Security Update Failed | |
| 166 | Info | Check for New Software Success | |
| 167 | Error | Check for New Software Failed | |
| 168 | Info | Manual Security Update Successful | |
| 169 | Error | Manual Security Update Failed | |
| 170 | Error | Manager Available Disk Space Too Low | The manager does not have enough free disk space to function and will shut down.Either expand the disk space or delete unused files to free some disk space, then Restart the Deep Security Manager. |
| 171 | Info | Anti-Malware Spyware Item Exported | |
| 172 | Info | Web Reputation Events Exported | |
| 173 | Info | Anti-Malware Identified Files List Exported | |
| 174 | Info | Anti-Malware Unauthorized Change Targeted Item Exported | |
| 180 | Info | Alert Type Updated | |
| 190 | Info | Alert Started | |
| 191 | Info | Alert Changed | |
| 192 | Info | Alert Ended | |
| 197 | Info | Alert Emails Sent | |
| 198 | Warning | Alert Emails Failed | An alert email could not be sent. Verify that your SMTP settings are correct. |
| 199 | Error | Alert Processing Failed | The current alert status could be inaccurate because an alert was not completely processed. If the problem persists, contact your support provider. |
| 248 | Info | Software Update: Disable Relay Requested | |
| 249 | Info | Software Update: Enable Relay Requested | |
| 250 | Info | Computer Created | |
| 251 | Info | Computer Deleted | |
| 252 | Info | Computer Updated | |
| 253 | Info | Policy Assigned to Computer | |
| 254 | Info | Computer Moved | |
| 255 | Info | Activation Requested | |
| 256 | Info | Send Policy Requested | |
| 257 | Info | Locked | |
| 258 | Info | Unlocked | |
| 259 | Info | Deactivation Requested | |
| 260 | Info | Scan for Open Ports | |
| 261 | Warning | Scan for Open Ports Failed | |
| 262 | Info | Scan for Open Ports Requested | |
| 263 | Info | Scan for Open Ports Canceled | |
| 264 | Info | Agent Software Upgrade Requested | |
| 265 | Info | Agent Software Upgrade Cancelled | |
| 266 | Info | Warnings/Errors Cleared | |
| 267 | Info | Check Status Requested | |
| 268 | Info | Get Events Requested | |
| 269 | Info | Computer Added to Cloud Connector | |
| 270 | Error | Computer Creation Failed | |
| 271 | Info | Agent Software Upgrade Timed Out | |
| 272 | Info | Appliance Software Upgrade Timed Out | |
| 273 | Info | Security Update: Security Update Check and Download Requested | |
| 274 | Info | Security Update: Security Update Rollback Requested | |
| 275 | Warning | Duplicate Computer | |
| 276 | Info | Update: Summary Information | |
| 277 | Info | Auto Agent Software Upgrade Skipped | The agent was eligible for an automatic upgrade, but the upgrade did not occur. For more information, see Automatically upgrade agents on activation. |
| 278 | Info | Software Update: Reboot to Complete Agent Software Upgrade | |
| 280 | Info | Computers Exported | |
| 281 | Info | Computers Imported | |
| 286 | Info | Computer Log Exported | |
| 287 | Info | Relay Group Assigned to Computer | |
| 290 | Info | Group Added | |
| 291 | Info | Group Removed | |
| 292 | Info | Group Updated | |
| 293 | Info | Interface Renamed | |
| 294 | Info | Computer Bridge Renamed | |
| 295 | Info | Interface Deleted | |
| 296 | Info | Interface IP Deleted | |
| 297 | Info | Recommendation Scan Requested | |
| 298 | Info | Recommendations Cleared | |
| 299 | Info | Asset Value Assigned to Computer | |
| 300 | Info | Recommendation Scan Completed | |
| 301 | Info | Agent Software Deployment Requested | |
| 302 | Info | Agent Software Removal Requested | |
| 303 | Info | Computer Renamed | |
| 305 | Info | Scan for Integrity Requested | |
| 306 | Info | Rebuild Baseline Requested | |
| 307 | Info | Cancel Update Requested | |
| 308 | Info | Integrity Monitoring Rule Compile Issue | |
| 309 | Info | Integrity Monitoring Rule Compile Issue Resolved | |
| 310 | Info | Directory Added | |
| 311 | Info | Directory Removed | |
| 312 | Info | Directory Updated | |
| 320 | Info | Directory Synchronization | |
| 321 | Info | Directory Synchronization Finished | |
| 322 | Error | Directory Synchronization Failed | |
| 323 | Info | Directory Synchronization Requested | |
| 324 | Info | Directory Synchronization Cancelled | |
| 325 | Info | User Synchronization | Synchronization of the user accounts with Microsoft Active Directory has been started. |
| 326 | Info | User Synchronization Finished | Synchronization of the user accounts with Microsoft Active Directory has completed. |
| 327 | Error | User Synchronization Failed | |
| 328 | Info | User Synchronization Requested | |
| 329 | Info | User Synchronization Cancelled | |
| 330 | Info | SSL Configuration Created | |
| 331 | Info | SSL Configuration Deleted | |
| 332 | Info | SSL Configuration Updated | |
| 333 | Info | Host Merge Finished | |
| 334 | Error | Host Merge Failed | |
| 338 | Warning | Directory Synchronization Limit Exceeded | Reached the limit of total group members for Active Directory synchronization. Skipping any remaining members. |
| 350 | Info | Policy Created | |
| 351 | Info | Policy Deleted | |
| 352 | Info | Policy Updated | |
| 353 | Info | Policies Exported | |
| 354 | Info | Policies Imported | |
| 355 | Info | Scan for Recommendations Canceled | |
| 360 | Info | VMware vCenter Added | |
| 361 | Info | VMware vCenter Removed | |
| 362 | Info | VMware vCenter Updated | |
| 363 | Info | VMware vCenter Synchronization | |
| 364 | Info | VMware vCenter Synchronization Finished | |
| 365 | Error | VMware vCenter Synchronization Failed | |
| 366 | Info | VMware vCenter Synchronization Requested | |
| 367 | Info | VMware vCenter Synchronization Cancelled | |
| 368 | Warning | Interfaces Out of Sync | Interfaces reported by the Deep Security Virtual Appliance are different than the interfaces reported by the vCenter. This can typically be resolved by rebooting the VM. |
| 369 | Info | Interfaces in Sync | |
| 370 | Info | Filter Driver Installed | |
| 371 | Info | Filter Driver Removed | The VMware ESXi server has been restored to the state it was in before the filter driver software was installed. |
| 372 | Info | Filter Driver Upgraded | |
| 373 | Info | Virtual Appliance Deployed | |
| 374 | Info | Virtual Appliance Upgraded | |
| 375 | Warning | Virtual Appliance Upgrade Failed | |
| 376 | Warning | Virtual Machine Moved to Unprotected ESXi | |
| 377 | Info | Virtual Machine Moved to Protected ESXi | |
| 378 | Warning | Virtual Machine unprotected after move to another ESXi | A VM was moved to an ESXi where there is no Deep Security Virtual Appliance. |
| 379 | Info | Virtual Machine unprotected after move to another ESXi Resolved | |
| 380 | Error | Filter Driver Offline | The filter driver on an ESXi server is offline. Use the VMware vCenter console to troubleshoot problems with the hypervisor and the ESXi. |
| 381 | Info | Filter Driver Back Online | |
| 382 | Info | Filter Driver Upgrade Requested | |
| 383 | Info | Appliance Upgrade Requested | |
| 384 | Warning | Prepare ESXi Failed | |
| 385 | Warning | Filter Driver Upgrade Failed | |
| 386 | Warning | Removal of Filter Driver from ESXi Failed | |
| 387 | Error | Connection to Filter Driver Failure | |
| 388 | Info | Connection to Filter Driver Success | |
| 389 | Error | Multiple Activated Appliances Detected | |
| 390 | Info | Multiple Activated Appliances Detected Resolved | |
| 391 | Error | Network Settings Out of Sync With vCenter Global Settings | |
| 392 | Info | Network Settings in Sync With vCenter Global Settings | |
| 393 | Error | Anti-Malware Engine Offline | The anti-malware protection module is not functioning. This is probably because the VMware environment does not meet the requirements. See System requirements. |
| 394 | Info | Anti-Malware Engine Back Online | |
| 395 | Error | Virtual Appliance is Incompatible With Filter Driver | |
| 396 | Info | Virtual Appliance is Incompatible With Filter Driver Resolved | |
| 397 | Warning | VMware NSX Callback Authentication Failed | |
| 398 | Error | VMware Tools Not Installed | |
| 399 | Info | VMware Tools Not Installed Resolved | |
| 410 | Info | Firewall Rule Created | |
| 411 | Info | Firewall Rule Deleted | |
| 412 | Info | Firewall Rule Updated | |
| 413 | Info | Firewall Rule Exported | |
| 414 | Info | Firewall Rule Imported | |
| 420 | Info | Firewall Stateful Configuration Created | |
| 421 | Info | Firewall Stateful Configuration Deleted | |
| 422 | Info | Firewall Stateful Configuration Updated | |
| 423 | Info | Firewall Stateful Configuration Exported | |
| 424 | Info | Firewall Stateful Configuration Imported | |
| 460 | Info | Application Type Created | An administrator configured a new IPS network application definition. |
| 461 | Info | Application Type Deleted | An administrator removed an IPS network application definition. |
| 462 | Info | Application Type Updated | An administrator changed an existing IPS network application definition. |
| 463 | Info | Application Type Exported | An administrator downloaded an IPS network application definition. |
| 464 | Info | Application Type Imported | An administrator uploaded an IPS network application definition. |
| 470 | Info | Intrusion Prevention Rule Created | |
| 471 | Info | Intrusion Prevention Rule Deleted | |
| 472 | Info | Intrusion Prevention Rule Updated | |
| 473 | Info | Intrusion Prevention Rule Exported | |
| 474 | Info | Intrusion Prevention Rule Imported | |
| 480 | Info | Integrity Monitoring Rule Created | |
| 481 | Info | Integrity Monitoring Rule Deleted | |
| 482 | Info | Integrity Monitoring Rule Updated | |
| 483 | Info | Integrity Monitoring Rule Exported | |
| 484 | Info | Integrity Monitoring Rule Imported | |
| 490 | Info | Log Inspection Rule Created | |
| 491 | Info | Log Inspection Rule Deleted | |
| 492 | Info | Log Inspection Rule Updated | |
| 493 | Info | Log Inspection Rule Exported | |
| 494 | Info | Log Inspection Rule Imported | |
| 495 | Info | Log Inspection Decoder Created | |
| 496 | Info | Log Inspection Decoder Deleted | |
| 497 | Info | Log Inspection Decoder Updated | |
| 498 | Info | Log Inspection Decoder Exported | |
| 499 | Info | Log Inspection Decoder Imported | |
| 505 | Info | Context Created | |
| 506 | Info | Context Deleted | |
| 507 | Info | Context Updated | |
| 508 | Info | Context Exported | |
| 509 | Info | Context Imported | |
| 510 | Info | IP List Created | |
| 511 | Info | IP List Deleted | |
| 512 | Info | IP List Updated | |
| 513 | Info | IP List Exported | |
| 514 | Info | IP List Imported | |
| 520 | Info | Port List Created | |
| 521 | Info | Port List Deleted | |
| 522 | Info | Port List Updated | |
| 523 | Info | Port List Exported | |
| 524 | Info | Port List Imported | |
| 525 | Info | Scan Cache Configuration Created | |
| 526 | Info | Scan Cache Configuration Exported | |
| 527 | Info | Scan Cache Configuration Updated | |
| 530 | Info | MAC List Created | |
| 531 | Info | MAC List Deleted | |
| 532 | Info | MAC List Updated | |
| 533 | Info | MAC List Exported | |
| 534 | Info | MAC List Imported | |
| 540 | Info | Proxy Created | |
| 541 | Info | Proxy Deleted | |
| 542 | Info | Proxy Updated | |
| 543 | Info | Proxy Exported | |
| 544 | Info | Proxy Imported | |
| 550 | Info | Schedule Created | |
| 551 | Info | Schedule Deleted | |
| 552 | Info | Schedule Updated | |
| 553 | Info | Schedule Exported | |
| 554 | Info | Schedule Imported | |
| 560 | Info | Scheduled Task Created | |
| 561 | Info | Scheduled Task Deleted | |
| 562 | Info | Scheduled Task Updated | |
| 563 | Info | Scheduled Task Manually Executed | |
| 564 | Info | Scheduled Task Started | |
| 565 | Info | Backup Finished | |
| 566 | Error | Backup Failed | |
| 567 | Info | Sending Outstanding Alert Summary | |
| 568 | Warning | Failed To Send Outstanding Alert Summary | |
| 569 | Warning | Email Failed | An e-mail notification could not be sent. Verify that your SMTP settings are correct. |
| 570 | Info | Sending Report | |
| 571 | Warning | Failed To Send Report | |
| 572 | Error | Invalid Report Jar | |
| 573 | Info | Asset Value Created | |
| 574 | Info | Asset Value Deleted | |
| 575 | Info | Asset Value Updated | |
| 576 | Error | Report Uninstall Failed | |
| 577 | Error | Report Uninstalled | |
| 578 | Warning | Integrity Monitoring Rules Require Configuration | |
| 580 | Warning | Application Type Port List Misconfiguration | |
| 581 | Warning | Application Type Port List Misconfiguration Resolved | |
| 582 | Warning | Intrusion Prevention Rules Require Configuration | |
| 583 | Info | Intrusion Prevention Rules Require Configuration Resolved | |
| 584 | Warning | Application Types Require Configuration | IPS rules require network application definitions, and cannot correctly scan traffic until you define them. |
| 585 | Info | Integrity Monitoring Rules Require Configuration Resolved | |
| 586 | Warning | Log Inspection Rules Require Configuration | |
| 587 | Info | Log Inspection Rules Require Configuration Resolved | |
| 588 | Warning | Log Inspection Rules Require Log Files | |
| 589 | Info | Log Inspection Rules Require Log Files Resolved | |
| 590 | Warning | Scheduled Task Unknown Type | |
| 591 | Info | Relay Group Created | |
| 592 | Info | Relay Group Updated | |
| 593 | Info | Relay Group Deleted | |
| 594 | Info | Event-Based Task Created | |
| 595 | Info | Event-Based Task Deleted | |
| 596 | Info | Event-Based Task Updated | |
| 597 | Info | Event-Based Task Triggered | |
| 600 | Info | User Signed In | |
| 601 | Info | User Signed Out | |
| 602 | Info | User Timed Out | |
| 603 | Info | User Locked Out | |
| 604 | Info | User Unlocked | |
| 605 | Info | User Session Terminated | |
| 608 | Error | User Session Validation Failed | Deep Security Manager could not confirm that a session was initiated after successful authentication. The user will be redirected to the login page, and asked to re-authenticate. This could be normal if the authenticated session list was cleared. |
| 609 | Error | User Made Invalid Request | Deep Security Manager received invalid request to access audit data (events). Access was denied. |
| 610 | Info | User Session Validated | |
| 611 | Info | User Viewed Firewall Event | |
| 613 | Info | User Viewed Intrusion Prevention Event | |
| 615 | Info | User Viewed System Event | |
| 616 | Info | User Viewed Integrity Monitoring Event | |
| 617 | Info | User Viewed Log Inspection Event | |
| 618 | Info | User Viewed Identified File Detail | |
| 619 | Info | User Viewed Anti-Malware Event | |
| 620 | Info | User Viewed Web Reputation Event | |
| 621 | Info | User Signed In As Tenant | |
| 622 | Info | Access from Primary Tenant Enabled | |
| 623 | Info | Access from Primary Tenant Disabled | |
| 624 | Info | Access from Primary Tenant Allowed | |
| 625 | Info | Access from Primary Tenant Revoked | |
| 626 | Info | Access from Primary Tenant Expired | |
| 630 | Info | Syslog Configuration Created | |
| 631 | Info | Syslog Configuration Deleted | |
| 632 | Info | Syslog Configuration Updated | |
| 633 | Info | Syslog Configuration Exported | |
| 634 | Info | Syslog Configuration Imported | |
| 650 | Info | User Created | |
| 651 | Info | User Deleted | |
| 652 | Info | User Updated | |
| 653 | Info | User Password Set | |
| 656 | Info | API Key Created | |
| 657 | Info | API Key Deleted | |
| 658 | Info | API Key Updated | |
| 660 | Info | Role Created | |
| 661 | Info | Role Deleted | |
| 662 | Info | Role Updated | |
| 663 | Info | Roles Imported | |
| 664 | Info | Roles Exported | |
| 670 | Info | Contact Created | |
| 671 | Info | Contact Deleted | |
| 672 | Info | Contact Updated | |
| 673 | Info | API Key Locked Out | |
| 674 | Info | API Key Unlocked | |
| 675 | Error | API Key Session Validation Failed | |
| 676 | Error | API Key Made Invalid Request | |
| 678 | Info | API Key Expired | |
| 700 | Info | Agent Software Installed | |
| 701 | Error | Agent Software Installation Failed | |
| 702 | Info | Credentials Generated | |
| 703 | Error | Credential Generation Failed | |
| 704 | Info | Activated | |
| 705 | Error | Activation Failed | This can occur if agent self-protection is enabled. On the Deep Security Manager, go to Computer editor To open the Computer editor, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General. In Agent Self Protection, and then either deselect Prevent local end-users from uninstalling, stopping, or otherwise modifying the Agent or enter a password for local override. |
| 706 | Info | Software Update: Agent Software Upgraded | |
| 707 | Warning | Software Update: Agent Software Upgrade Failed | Refer to the event details for more information about why the upgrade was not successful. |
| 708 | Info | Deactivated | |
| 709 | Error | Deactivation Failed | |
| 710 | Info | Events Retrieved | |
| 711 | Info | Agent Software Deployed | |
| 712 | Error | Agent Software Deployment Failed | This can occur if agent self-protection is enabled. On the Deep Security Manager, go to Computer editorTo open the Computer editor, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General. In Agent Self Protection, and then either deselect Prevent local end-users from uninstalling, stopping, or otherwise modifying the Agent or enter a password for local override. |
| 713 | Info | Agent Software Removed | |
| 714 | Error | Agent Software Removal Failed |
This can occur if agent self-protection is enabled. On the Deep Security Manager, go to Computer editor |
| 715 | Info | Agent/Appliance Version Changed | |
| 716 | Info | Reactivation Attempted by Unknown Agent | An agent that is currently unknown to the Deep Security Manager has attempted reactivation. This usually happens when a computer was deleted from Deep Security Manager without first removing the agent on the computer. For more information, see the 'Reactivation Attempted by Unknown Agent' section in Agent settings. |
| 720 | Info | Policy Sent | Agent/Appliance updated. |
| 721 | Error | Send Policy Failed | |
| 722 | Warning | Get Interfaces Failed | |
| 723 | Info | Get Interfaces Failure Resolved | |
| 724 | Warning | Insufficient Disk Space | An agent detected low disk space. Free space on the computer. See Warning: Insufficient disk space. |
| 725 | Warning | Events Suppressed | |
| 726 | Warning | Get Agent/Appliance Events Failed | Manager was unable to retrieve Events from Agent/Appliance. This error does not mean that the data was lost on the Agent/Appliance. This error is normally caused by a network interruption while events are being transferred. Clear the error and run a "Check Status" to retry the operation. |
| 727 | Info | Get Agent/Appliance Events Failure Resolved | |
| 728 | Error | Get Events Failed | Manager was unable to retrieve audit data from Agent/Appliance. This error does not mean that the data was lost on the Agent/Appliance. This error is normally caused by a network interruption while events are being transferred. Clear the error and run a "Get Events Now" to retry the operation. |
| 729 | Info | Get Events Failure Resolved | |
| 730 | Error | Offline | Manager cannot communicate with Computer. Usually, however, the offline Agent is still protecting the computer with its last configured settings. See Computer and Agent/Appliance Status and "Offline" agent. |
| 731 | Info | Back Online | |
| 732 | Error | Firewall Engine Offline | The Firewall Engine is offline and traffic is flowing unfiltered. This is normally due to an error during installation or verification of the driver on the computer's OS platform. Check the status of the network driver at the computer to ensure it is properly loaded. |
| 733 | Info | Firewall Engine Back Online | |
| 734 | Warning | Computer Clock Change | A clock change has occurred on the Computer which exceeds the maximum allowed specified in Computer or Policy editorYou can change these settings for a policy or for a specific computer.
To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details).
To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General > Heartbeat area. Investigate what has caused the clock change on the computer. |
| 735 | Warning | Misconfiguration Detected | The Agent's configuration does not match the configuration indicated in the Manager's records. This is typically because of a recent backup restoration of the Manager or the Agent. Unanticipated misconfiguration warnings should be investigated. |
| 736 | Info | Check Status Failure Resolved | |
| 737 | Error | Check Status Failed | See Error: Check Status Failed. |
| 738 | Error | Intrusion Prevention Engine Offline | The Intrusion Prevention Engine is offline and traffic is flowing unfiltered. This is normally due to an error during installation or verification of the driver on the computer's OS platform. Check the status of the network driver at the computer to ensure it is properly loaded. |
| 739 | Info | Intrusion Prevention Engine Back Online | |
| 740 | Error | Agent/Appliance Error | |
| 741 | Warning | Abnormal Restart Detected | |
| 742 | Warning | Communications Problem | The Agent is having problems communicating its status to Manager. It usually indicates network or load congestion in the Agent --> Manager direction. Further investigation is warranted if the situation persists |
| 743 | Info | Communications Problem Resolved | |
| 745 | Warning | Events Truncated | |
| 748 | Error | Log Inspection Engine Offline | |
| 749 | Info | Log Inspection Engine Back Online | |
| 750 | Warning | Last Automatic Retry | |
| 755 | Info | Deep Security Manager Version Compatibility Resolved | |
| 756 | Warning | Deep Security Manager Upgrade Recommended (Incompatible Security Update(s)) |
Each security module rule (such as Firewall, Anti-Malware, and the others) has a specific minimum Deep Security Manager version that's required in order for the rule to run. Your current Deep Security Manager version is less than the rule's minimum supported version. Upgrade your Deep Security Manager to clear the warning and run the rule. |
| 760 | Info | Agent/Appliance Version Compatibility Resolved | |
| 761 | Warning | Agent/Appliance Upgrade Recommended | Your current Deep Security Agent or Deep Security Virtual Appliance version is less than the Deep Security Manager's minimum supported version. Upgrade your Agent/Appliance. |
| 762 | Warning | Agent/Appliance Upgrade Required | |
| 763 | Warning | Incompatible Agent/Appliance Version | Your current Deep Security Manager version is less than the Deep Security Agent or Deep Security Virtual Appliance's minimum supported version. Upgrade your manager. |
| 764 | Warning | Agent/Appliance Upgrade Recommended (Incompatible Security Update(s)) |
Each security module rule (such as Firewall, Anti-Malware, and the others) has a specific minimum Deep Security Agent or Deep Security Virtual Appliance version that's required in order for the rule to run. Your current Deep Security Agent or Deep Security Virtual Appliance version is less than the rule's minimum supported version. Upgrade your Deep Security Agent or Deep Security Virtual Appliance to clear the warning and run the rule. |
| 765 | Error | Computer Reboot Required | |
| 766 | Warning | Network Engine Mode Configuration Incompatibility | |
| 767 | Warning | Network Engine Mode Version Incompatibility | |
| 768 | Warning | Network Engine Mode Incompatibility Resolved | |
| 770 | Warning | Agent/Appliance Heartbeat Rejected | |
| 771 | Warning | Contact by Unrecognized Client | See Troubleshoot event ID 771 "Contact by Unrecognized Client". |
| 780 | Info | Recommendation Scan Failure Resolved | |
| 781 | Warning | Recommendation Scan Failure | See Troubleshooting: Recommendation Scan Failure. |
| 782 | Info | Rebuild Baseline Failure Resolved | |
| 783 | Warning | Rebuild Baseline Failure | |
| 784 | Info | Security Update: Security Update Check and Download Successful | |
| 785 | Warning | Security Update: Security Update Check and Download Failed | |
| 786 | Info | Scan For Change Failure Resolved | |
| 787 | Warning | Scan For Change Failure | |
| 790 | Info | Agent-Initiated Activation Requested | |
| 791 | Warning | Agent-Initiated Activation Failure | |
| 792 | Info | Manual Malware Scan Failure Resolved | |
| 793 | Warning | Manual Malware Scan Failure | A Malware Scan has failed. Use the VMware vCenter console to check the status of the VM on which the scan failed. |
| 794 | Info | Scheduled Malware Scan Failure Resolved | |
| 795 | Warning | Scheduled Malware Scan Failure | A scheduled Malware Scan has failed. Use the VMware vCenter console to check the status of the VM on which the scan failed. |
| 796 | Warning | Scheduled Malware Scan Task has been Missed | This occurs when a scheduled Malware Scan is initiated on a computer when a previous scan is still pending. This typically indicates that Malware Scans are being scheduled too frequently. |
| 797 | Info | Malware Scan Cancellation Failure Resolved | |
| 798 | Warning | Malware Scan Cancellation Failure | A Malware Scan cancellation has failed. Use the VMware vCenter console to check the status of the VM on which the scan failed. |
| 799 | Warning | Malware Scan Stalled | A Malware Scan has stalled. Use the VMware vCenter console to check the status of the VM on which the scan stalled. |
| 800 | Info | Alert Dismissed | |
| 801 | Info | Error Dismissed | |
| 803 | Warning | Agent Configuration Package too Large | |
| 804 | Error | Intrusion Prevention Rule Compiler Failed | |
| 805 | Error | Intrusion Prevention Rules Failed to Compile | |
| 806 | Error | Intrusion Prevention Rules Failed to Compile | |
| 850 | Warning | Reconnaissance Detected: Computer OS Fingerprint Probe | See Warning: Reconnaissance Detected |
| 851 | Warning | Reconnaissance Detected: Network or Port Scan | See Warning: Reconnaissance Detected |
| 852 | Warning | Reconnaissance Detected: TCP Null Scan | See Warning: Reconnaissance Detected |
| 853 | Warning | Reconnaissance Detected: TCP SYNFIN Scan | See Warning: Reconnaissance Detected |
| 854 | Warning | Reconnaissance Detected: TCP Xmas Scan | See Warning: Reconnaissance Detected |
| 900 | Info | Deep Security Manager Audit Started | |
| 901 | Info | Deep Security Manager Audit Shutdown | |
| 902 | Info | Deep Security Manager Installed | |
| 903 | Warning | License Related Configuration Change | |
| 904 | Info | Diagnostic Logging Enabled | |
| 905 | Info | Diagnostic Logging Completed | |
| 910 | Info | Diagnostic Package Generated | |
| 911 | Info | Diagnostic Package Exported | |
| 912 | Info | Diagnostic Package Uploaded | |
| 913 | Error | Automatic Diagnostic Package Error | |
| 914 | Info | Identified File Deletion Succeeded | |
| 915 | Info | Identified File Deletion Failed | |
| 916 | Info | Identified File Download Succeeded | |
| 917 | Info | Identified File Download Failed | |
| 918 | Info | Identified File Administration Utility Download Succeeded | |
| 919 | Info | Identified File Not Found | |
| 920 | Info | Usage Information Generated | |
| 921 | Info | Usage Information Package Exported | |
| 922 | Info | Usage Information Package Uploaded | |
| 923 | Error | Usage Information Package Error | |
| 924 | Warning | File cannot be analyzed or quarantined (VM maximum disk space used to store identified files exceeded) | The Anti-Malware module was unable to analyze or quarantine a file because the VM maximum disk space used to store identified files was reached. To change the maximum disk space for identified files setting, open the computer or policy editor and go to the Anti-malware > Advanced tab. |
| 925 | Warning | File cannot be analyzed or quarantined (maximum disk space used to store identified files exceeded) | The Anti-Malware module was unable to analyze or quarantine a file because the maximum disk space used to store identified files was reached. To change the maximum disk space for identified files setting, open the computer or policy editor and go to the Anti-malware > Advanced tab. |
| 926 | Warning | Smart Protection Server Disconnected for Smart Scan | See Troubleshoot "Smart Protection Server disconnected" errors. |
| 927 | Info | Smart Protection Server Connected for Smart Scan | |
| 928 | Info | Identified File Restoration Succeeded | |
| 929 | Warning | Identified File Restoration Failed | |
| 930 | Info | Certificate Accepted | |
| 931 | Info | Certificate Deleted | |
| 932 | Warning | Smart Protection Server Disconnected for Web Reputation | See Troubleshoot "Smart Protection Server disconnected" errors. |
| 933 | Info | Smart Protection Server Connected for Web Reputation | |
| 934 | Info | Software Update: Anti-Malware Windows Platform Update Successful | |
| 935 | Error | Software Update: Anti-Malware Windows Platform Update Failed | See Anti-Malware Windows platform update failed |
| 936 | Info | Submission of identified file to Deep Discovery Analyzer succeeded | |
| 937 | Info | Submission of identified file to Deep Discovery Analyzer failed | |
| 938 | Info | Identified File Submission Queued | |
| 940 | Info | Auto-Tag Rule Created | |
| 941 | Info | Auto-Tag Rule Deleted | |
| 942 | Info | Auto-Tag Rule Updated | |
| 943 | Info | Tag Deleted | |
| 944 | Info | Tag Created | |
| 945 | Warning | Census, Good File Reputation, and Predictive Machine Learning Service Disconnected | |
| 946 | Info | Census, Good File Reputation, and Predictive Machine Learning Service Connected | |
| 947 | Info | FIPS Mode Enabled | |
| 948 | Info | FIPS Mode Disabled | |
| 970 | Info | Command Line Utility Started | |
| 978 | Info | Command Line Utility Failed | |
| 979 | Info | Command Line Utility Shutdown | Deep Security Manager was manually stopped. |
| 980 | Info | System Information Exported | |
| 990 | Info | Manager Node Added | |
| 991 | Info | Manager Node Decommissioned | |
| 992 | Info | Manager Node Updated | |
| 995 | Info | Connection to the Certified Safe Software Service has been restored | |
| 996 | Warning | Unable to connect to the Certified Safe Software Service | |
| 997 | Error | Tagging Error | |
| 998 | Error | System Event Notification Error | |
| 999 | Error | Internal Software Error | |
| 1101 | Error | Plug-in Installation Failed | |
| 1102 | Info | Plug-in Installed | |
| 1103 | Error | Plug-in Upgrade Failed | |
| 1104 | Info | Plug-in Upgraded | |
| 1105 | Error | Plug-in Start Failed | |
| 1106 | Error | Plug-in Uninstall Failed | |
| 1107 | Info | Plug-in Uninstalled | |
| 1108 | Info | Plug-in Started | |
| 1109 | Info | Plug-in Stopped | |
| 1110 | Error | Software Package Not Found | Agent software package was not found or a newer package is required. |
| 1111 | Info | Software Package Found | |
| 1500 | Info | Malware Scan Configuration Created | |
| 1501 | Info | Malware Scan Configuration Deleted | |
| 1502 | Info | Malware Scan Configuration Updated | |
| 1503 | Info | Malware Scan Configuration Exported | |
| 1504 | Info | Malware Scan Configuration Imported | |
| 1505 | Info | Directory List Created | |
| 1506 | Info | Directory List Deleted | |
| 1507 | Info | Directory List Updated | |
| 1508 | Info | Directory List Exported | |
| 1509 | Info | Directory List Imported | |
| 1510 | Info | File Extension List Created | |
| 1511 | Info | File Extension List Deleted | |
| 1512 | Info | File Extension List Updated | |
| 1513 | Info | File Extension List Exported | |
| 1514 | Info | File Extension List Imported | |
| 1515 | Info | File List Created | |
| 1516 | Info | File List Deleted | |
| 1517 | Info | File List Updated | |
| 1518 | Info | File List Exported | |
| 1519 | Info | File List Imported | |
| 1520 | Info | Manual Malware Scan Pending | |
| 1521 | Info | Manual Malware Scan Started | |
| 1522 | Info | Manual Malware Scan Completed | |
| 1523 | Info | Scheduled Malware Scan Started | |
| 1524 | Info | Scheduled Malware Scan Completed | |
| 1525 | Info | Manual Malware Scan Cancellation In Progress | |
| 1526 | Info | Manual Malware Scan Cancellation |
This event can have several causes:
For details, see the system event description. |
| 1527 | Info | Scheduled Malware Scan Cancellation In Progress | |
| 1528 | Info | Scheduled Malware Scan Cancellation |
This event can have several causes:
For details, see the system event description. |
| 1529 | Info | Manual Malware Scan Paused | |
| 1530 | Info | Manual Malware Scan Resumed | |
| 1531 | Info | Scheduled Malware Scan Paused | |
| 1532 | Info | Scheduled Malware Scan Resumed | |
| 1533 | Info | Computer reboot required for Anti-Malware cleanup task | |
| 1534 | Error | Computer reboot required for Anti-Malware protection | |
| 1535 | Info | Anti-Malware cleanup task must be performed manually | |
| 1536 | Info | Quick Malware Scan Pending | |
| 1537 | Info | Quick Malware Scan Started | |
| 1538 | Info | Quick Malware Scan Completed | |
| 1539 | Info | Quick Malware Scan Cancellation In Progress | |
| 1540 | Info | Quick Malware Scan Cancellation |
This event can have several causes:
For details, see the system event description. |
| 1541 | Info | Quick Malware Scan Paused | |
| 1542 | Info | Quick Malware Scan Failure Resolved | |
| 1543 | Warning | Quick Malware Scan Failure | |
| 1544 | Info | Quick Malware Scan Resumed | |
| 1545 | Info | Files could not be scanned for malware | Anti-malware could not scan a file because its file path exceeded the maximum number of characters. Maximum file path length varies by OS and file system. To prevent this problem, try moving the file to a directory path and file name with fewer characters. |
| 1546 | Info | Files could not be scanned for malware | Anti-malware could not scan a file because its location exceeded the maximum directory depth. To prevent this problem, try reducing the number of layers of nested directories. |
| 1547 | Info | Scheduled Malware Scan Task has been cancelled | |
| 1550 | Info | Web Reputation Settings Updated | |
| 1551 | Info | Malware Scan Configuration Updated | |
| 1552 | Info | Integrity Configuration Updated | |
| 1553 | Info | Log Inspection Configuration Updated | |
| 1554 | Info | Firewall Stateful Configuration Updated | |
| 1555 | Info | Intrusion Prevention Configuration Updated | |
| 1600 | Info | Relay Group Update Requested | |
| 1601 | Info | Relay Group Update Success | |
| 1602 | Error | Relay Group Update Failed | |
| 1603 | Info | Security Update: Security Update Rollback Success | |
| 1604 | Warning | Security Update: Security Update Rollback Failure | |
| 1605 | Info | Successfully send file back up command to host | |
| 1606 | Warning | Failed to send file back up command to host | |
| 1607 | Info | Successfully back up file | |
| 1608 | Error | Failed to back up file | |
| 1650 | Warning | Anti-Malware protection is not enabled or is out of date | |
| 1651 | Info | Anti-Malware module is ready | |
| 1660 | Info | Rebuild Baseline Started | |
| 1661 | Info | Rebuild Baseline Paused | |
| 1662 | Info | Rebuild Baseline Resumed | |
| 1663 | Warning | Rebuild Baseline Failure | |
| 1664 | Warning | Rebuild Baseline Stalled | |
| 1665 | Info | Rebuild Baseline Completed | |
| 1666 | Info | Scan for Integrity Started | |
| 1667 | Info | Scan for Integrity Paused | |
| 1668 | Info | Scan for Integrity Resumed | |
| 1669 | Warning | Scan for Integrity Failure | |
| 1670 | Warning | Scan for Integrity Stalled | |
| 1671 | Info | Scan for Integrity Completed | |
| 1675 | Error | Integrity Monitoring Engine Offline | |
| 1676 | Info | Integrity Monitoring Engine Back Online | |
| 1677 | Error | Trusted Platform Module Error | |
| 1678 | Info | Trusted Platform Module Register Values Loaded | |
| 1679 | Warning | Trusted Platform Module Register Values Changed | |
| 1680 | Info | Trusted Platform Module Checking Disabled | |
| 1681 | Info | Trusted Platform Module Information Unreliable | |
| 1700 | Info | No Agent Detected | |
| 1800 | Error | Deep Security Protection Module Failure | |
| 1801 | Info | Deep Security Protection Module Back to Normal | |
| 1900 | Info | Cloud Account Added | |
| 1901 | Info | Cloud Account Removed | |
| 1902 | Info | Cloud Account Updated | |
| 1903 | Info | Cloud Account Synchronization In Progress | |
| 1904 | Info | Cloud Account Synchronization Finished | |
| 1905 | Error | Cloud Account Synchronization Failed | |
| 1906 | Info | Cloud Account Synchronization Requested | |
| 1907 | Info | Cloud account Synchronization Cancelled | |
| 1908 | Info | AWS Account Synchronization Requested | |
| 1909 | Info | AWS Account Synchronization Finished | |
| 1910 | Error | AWS Account Synchronization Failed | |
| 1911 | Info | AWS Account Added | |
| 1912 | Info | AWS Account Removed | |
| 1913 | Info | AWS Account Updated | |
| 1914 | Info | Azure Account Added | |
| 1915 | Info | Azure Account Removed | |
| 1916 | Info | Azure Account Updated | |
| 1917 | Info | Azure Account Synchronization Finished | |
| 1918 | Error | Azure Account Synchronization Failed | |
| 1919 | Info | Azure Account Synchronization Requested | |
| 1920 | Warning | Azure Account Synchronization Completed but with Errors | |
| 1921 | Info | vCloud Account Added | |
| 1922 | Info | vCloud Account Removed | |
| 1923 | Info | vCloud Account Updated | |
| 1924 | Info | vCloud Account Synchronization Finished | |
| 1925 | Error | vCloud Account Synchronization Failed | |
| 1926 | Info | vCloud Account Synchronization Requested | |
| 1927 | Info | Upgrade Connector to AWS Account Requested | |
| 1928 | Warning | AWS Account Update Failed | |
| 1929 | Info | Upgrade Connector to AWS Account Finished | |
| 1950 | Info | Tenant Created | |
| 1951 | Info | Tenant Deleted | |
| 1952 | Info | Tenant Updated | |
| 1953 | Info | Tenant Database Server Created | |
| 1954 | Info | Tenant Database Server Deleted | |
| 1955 | Info | Tenant Database Server Updated | |
| 1956 | Info | Tenant Exported | |
| 1957 | Error | Tenant Initialization Failure | |
| 1958 | Info | Tenant Features Updated | |
| 2000 | Info | Scan Cache Configuration Object Added | |
| 2001 | Info | Scan Cache Configuration Object Removed | |
| 2002 | Info | Scan Cache Configuration Object Updated | |
| 2102 | Info | Cleverbridge Quantity Updated | |
| 2103 | Warning | Cleverbridge Quantity Not Updated | |
| 2104 | Info | Cleverbridge Quantity Reset | |
| 2105 | Warning | Cleverbridge Quantity Not Reset | |
| 2106 | Info | Cleverbridge Billing Date Set | |
| 2107 | Warning | Cleverbridge Billing Date Not Set | |
| 2110 | Info | Cleverbridge Notification Received | |
| 2112 | Info | Account Balance Reset | |
| 2113 | Info | Agent Installation Requested | |
| 2114 | Info | AWS Billing Job Started | |
| 2115 | Info | AWS Billing Job Completed | |
| 2116 | Error | AWS Billing failure | Deep Security Manager sent a billing usage record to AWS using the AWS SDK, which the SDK returned with an exception. If the problem persists, contact your support provider. |
| 2117 | Info | Entitlement Created | |
| 2118 | Info | Entitlement Updated | |
| 2119 | Error | Agent Activation Prevented Due to AWS Metering Billing Usage Data Submission Failure | |
| 2120 | Error | AWS Billing failure | Deep Security Manager encountered an error while executing an AWS billing job. If the problem persists, contact your support provider. |
| 2200 | Info | Software Update: Anti-Malware Module Installation Started | |
| 2201 | Info | Software Update: Anti-Malware Module Installation Successful | This event is also triggered by installing Application Control or Integrity Monitoring because they share the same framework as Anti-Malware. |
| 2202 | Warning | Software Update: Anti-Malware Module Installation Failed | |
| 2203 | Info | Software Update: Anti-Malware Module Download Successful | |
| 2204 | Info | Security Update: Pattern Update on Agents/Appliances Successful | |
| 2205 | Warning | Security Update: Pattern Update on Agents/Appliances Failed | |
| 2206 | Info | Security Update: Pattern Update on Agents/Appliances Skipped | |
| 2300 | Info | Software Update: Web Reputation Module Installation Started | |
| 2301 | Info | Software Update: Web Reputation Module Installation Successful | |
| 2302 | Warning | Software Update: Web Reputation Module Installation Failed | |
| 2303 | Info | Software Update: Web Reputation Download Successful | |
| 2400 | Info | Software Update: Firewall Module Installation Started | |
| 2401 | Info | Software Update: Firewall Module Installation Successful | |
| 2402 | Warning | Software Update: Firewall Module Installation Failed | |
| 2403 | Info | Software Update: Firewall Module Download Successful | |
| 2500 | Info | Software Update: Intrusion Prevention Module Installation Started | |
| 2501 | Info | Software Update: Intrusion Prevention Module Installation Successful | |
| 2502 | Warning | Software Update: Intrusion Prevention Module Installation Failed | |
| 2503 | Info | Software Update: Intrusion Prevention Module Download Successful | |
| 2600 | Info | Software Update: Integrity Monitoring Module Installation Started | |
| 2601 | Info | Software Update: Integrity Monitoring Module Installation Successful | |
| 2602 | Warning | Software Update: Integrity Monitoring Module Installation Failed | |
| 2603 | Info | Software Update: Integrity Monitoring Module Download Successful | |
| 2700 | Info | Software Update: Log Inspection Module Installation Started | |
| 2701 | Info | Software Update: Log Inspection Module Installation Successful | |
| 2702 | Warning | Software Update: Log Inspection Module Installation Failed | |
| 2703 | Info | Software Update: Log Inspection Module Download Successful | |
| 2800 | Info | Software Update: Software Automatically Downloaded | |
| 2801 | Error | Software Update: Unable to retrieve Download Center inventory | |
| 2802 | Error | Software Update: Unable to download software from Download Center | |
| 2803 | Info | Online Help Update Started | |
| 2804 | Info | Online Help Update Ended | |
| 2805 | Info | Online Help Update Success | |
| 2806 | Warning | Online Help Update Failed | |
| 2900 | Info | Software Update: Relay Module Installation Started | |
| 2901 | Info | Software Update: Relay Module Installation Successful | |
| 2902 | Warning | Software Update: Relay Module Installation Failed | |
| 2903 | Info | Software Update: Relay Module Download Successful | |
| 2904 | Info | VMware NSX Synchronization Finished | |
| 2905 | Error | VMware NSX Synchronization Failed | |
| 2906 | Info | Agent Self-Protection enabled | Agent self-protection was enabled via the Deep Security Manager. |
| 2907 | Info | Agent Self-Protection disabled | |
| 2908 | Info | Agent Self-Protection enabled | Agent self-protection was enabled via the command line on the Deep Security Agent. |
| 2909 | Info | Agent Self-Protection disabled | |
| 2915 | Info | Data migration complete | |
| 2916 | Warning | Data migration finished with error | |
| 2920 | Info | Querying report from DDAn Finished | |
| 2921 | Error | Querying report from DDAn Failed | |
| 2922 | Info | Submission to Deep Discovery Analyzer processed | |
| 2923 | Error | File submission to Deep Discovery Analyzer Failed | |
| 2924 | Info | Security Update: Suspicious Object Check and Update Successful | |
| 2925 | Error | Security Update: Suspicious Object Check and Update Failed | |
| 2926 | Warning | Submission to Deep Discovery Analyzer queued | |
| 2930 | Info | File back up pending | |
| 2931 | Info | Smart Folder Added | |
| 2932 | Info | Smart Folder Removed | |
| 2933 | Info | Smart Folder Updated | |
| 2934 | Error | Failed to send Amazon SNS message | |
| 2935 | Info | System resumed sending SNS messages | |
| 2936 | Info | Inactive User Deleted | |
| 2937 | Info | SAML Identity Provider Created | |
| 2938 | Info | SAML Identity Provider Updated | |
| 2939 | Info | SAML Identity Provider Deleted | |
| 2940 | Info | SAML Service Provider Updated | |
| 2941 | Error | Failed to Update News | |
| 2942 | Info | Performance Profile Created | |
| 2943 | Info | Performance Profile Updated | |
| 2944 | Info | Performance Profile Deleted | |
| 2945 | Info | System Upgrade Started | |
| 2946 | Info | System Update Succeeded | |
| 2947 | Error | System Upgrade Failed | |
| 2948 | Info | Manager Node Upgrade Started | |
| 2949 | Info | Manager Node Update Succeeded | |
| 2950 | Error | Manager Node Upgrade Failed | A node in a multi-node environment failed to upgrade. |
| 2951 | Error | Failed to send TIC message | Managed Detection and Response events failed to send. |
| 2952 | Info | System resumed sending TIC messages | |
| 2953 | Info | Inactive Agent Cleanup Completed Successfully | Inactive Agent Cleanup removed computers that have been offline and inactive for a specified period of time. For more information on Inactive Agent Cleanup, see Automate offline computer removal with inactive agent cleanup. |
| 2954 | Warning | Dropped events recorded in the future | |
| 2969 | Info | Scheduled Task Skipped | |
| 7000 | Info | Application Control Security Events Exported | An administrator downloaded application control event logs in CSV format. |
| 7007 | Info | User Viewed Application Control Event | An administrator dismissed an application control alert. This is normal unless your system has been compromised by an intruder that has gained an administrator login. |
| 7008 | Error | Application Control Engine Offline | An agent's application control engine failed to come online. This could happen if you have enabled application control on a computer whose kernel is not supported. |
| 7009 | Info | Application Control Engine Online Again | An agent's application control engine restarted. |
| 7010 | Info | Application Control Configuration Updated | Deep Security Manager updated the application control settings on an agent. |
| 7011 | Info | Software Update: Application Control Module Installation Started | The agent received a policy from Deep Security Manager where application control was selected, but detected that it did not have the application control engine installed or needed to update it, so it began to download it. This is normal when you enable application control on a computer for the first time, or when it has been disabled while application control engine updates were released. |
| 7012 | Info | Software Update: Application Control Module Installation Successful | The agent installed the application control engine. The application control engine is also used by the integrity monitoring feature. |
| 7013 | Error | Software Update: Application Control Module Installation Failed | The agent could not install the application control engine. This is not normal. |
| 7014 | Info | Software Update: Application Control Module Download Successful | The agent finished downloading the application control engine. |
| 7015 | Info | Application Control Ruleset Rules Updated | The legacy REST API was used to allow or block software. This message does not occur when administrators perform the same action in the GUI. |
| 7020 | Info | Application Control Inventory Retrieved | The legacy REST API uploaded a computer's initial allow rules to Deep Security Manager. |
| 7021 | Info | Application Control Inventory Scan Started | The application control engine was enabled, and the agent detected that it did not have any allow rules for that computer, so it began to build initial rules based on the currently installed software. This is normal when you enable application control for the first time. This message does not occur when you use the legacy REST API to replace the allow rules. |
| 7022 | Info | Application Control Inventory Scan Completed | The agent finished building the initial allow rules for that computer. After this, any new software that is detected which is not in the allow or block rules will, if configured, cause and alert. |
| 7023 | Error | Application Control Inventory Scan Failed | The agent could not build the initial allow rules for that computer. This is not normal. |
| 7024 | Info | Application Control Software Changes Detected | An administrator allowed or blocked software in the Actions tab, or changed a rule by clicking Change rule in an application control log message. This message does not occur when you use the legacy REST API to replace the allow rules. |
| 7025 | Info | Application Control Inventory Scan Requested | You manually forced application control to delete the current rules and rebuild them based on the currently installed software. This could be normal if you needed to change many rules at the same time. |
| 7026 | Info | Application Control Maintenance Mode Start Requested | Either an administrator sent or the legacy REST API received the command to enable maintenance mode. |
| 7027 | Info | Application Control Maintenance Mode Stop Requested | Either an administrator sent or the legacy REST API received the command to disable maintenance mode. |
| 7028 | Info | Application Control Maintenance Mode Started | Maintenance mode was enabled. While enabled, the agent automatically adds updated or newly installed software to its allow rules, indicating that you know and want to allow the software update. The agent continues to apply block rules during this time. |
| 7029 | Info | Application Control Maintenance Mode Stopped | Maintenance mode was disabled. Once maintenance mode is stopped, all new or changed software will be considered "unrecognized" until you specifically allow or block it. |
| 7030 | Info | Application Control Inventory Scan Cancelled | The agent began to build the initial allow rules, but an administrator canceled the process. |
| 7031 | Error | Sending Application Control Ruleset Failed | An agent could not download a shared ruleset for application control. This can occur if network connectivity is interrupted (such as a firewall or proxy between the agent and relay), or if there isn't enough free disk space on the agent. |
| 7032 | Info | Sending Application Control Ruleset Succeeded | An agent downloaded a shared ruleset for application control. This normally occurs whenever an administrator or the legacy REST API allows or blocks software, or when a different shared ruleset is applied. |
| 7033 | Info | Application Control Ruleset Created | The legacy REST API was used to create an application control ruleset. This message does not occur when administrators perform the same action in the GUI. |
| 7034 | Info | Application Control Ruleset Updated | The legacy REST API was used to allow or block software via an application control ruleset. This message does not occur when administrators perform the same action in the GUI. |
| 7035 | Info | Application Control Ruleset Deleted | The legacy REST API was used to delete an application control ruleset. This message does not occur when administrators perform the same action in the GUI. |
| 7036 | Info | Application Control Maintenance Mode Reset Duration Requested | An administrator changed the time period for when maintenance mode is active. |
| 7037 | Error | Newly applied ruleset will block some running processes on restart | An administrator applied a new ruleset, but some of the currently running processes exist in block rules. Application control will not terminate the processes, but the next time you reboot or restart those services, depending on your configuration, it will either alert you or block them. If the processes are not authorized, you should terminate them manually. If they are authorized, but are missing from the ruleset, you should add them to the ruleset. |
| 7038 | Error | Unresolved software change limit reached | Software changes detected on the file system exceeded the maximum amount. Application control will continue to enforce existing rules, but will not record any more changes, and it will stop displaying any of that computer's software changes. You must resolve and prevent excessive software change. |
| 7040 | Error | Incompatible Application Control Ruleset | An application control ruleset could not be assigned to one or more computers because the ruleset is not supported by the installed version of the agent. Typically, the problem is that a hash-based ruleset (which is compatible only with Deep Security Agent 11.0 or newer) has been assigned to an older Deep Security Agent. Deep Security Agent 10.x supports only file-based rulesets. (For details, see Differences in how Deep Security Agent 10 and 11 compare files.) To fix this issue, upgrade the Deep Security Agent to version 11.0 or newer. Alternatively, if you are using local rulesets, reset application control for the agent. Or if you are using a shared ruleset, use a shared ruleset that was created with Deep Security 10.x until all agents using the shared ruleset are upgraded to Deep Security Agent 11.0 or newer. |
| 7041 | Info | Application Control Ruleset Upgraded | An application control ruleset was upgraded from a file-based ruleset to a hash-based ruleset. (For details, see Differences in how Deep Security Agent 10 and 11 compare files.) |
| 7042 | Info | Application Control Software Inventory Deleted |