Audit Events Tables
The tables in this section summarize the content of the different events tables.
ADDITIONALINFONUM1 shortened to Num1
ADDITIONALINFONUM2 shortened to Num2
ADDITIONALINFOCHAR1 shortened to Char1
ADDITIONALINFOCHAR2 shortened to Char2
Device Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20002 |
<Device CUID> |
<Operator ID> |
RequestCredential |
100 |
Credential is requested |
GUI and CCM API |
0 |
0 |
<device type> |
<application new status> |
|
20002 |
<Device CUID> |
<Operator ID> |
RequestCredential |
301 |
Credential request failed |
GUI and CCM API |
0 |
0 |
<device type> |
Null |
|
20003 |
<Device CUID> |
<Operator ID> |
RequestIssuance |
100 |
Device issuance is started |
GUI and CCM API |
<TemporaryStatus>: 0 – No 1 – Yes |
0 |
<device type> |
<device policy> |
|
20003 |
<Device CUID> |
<Operator ID> |
RequestIssuance |
301 |
Device issuance failed to start |
GUI and CCMAPI |
<TemporaryStatus>: 0 – No 1 – Yes |
0 |
<device type> |
<device policy> |
|
20004 |
<Device CUID> |
<Operator ID> |
RequestRecycle |
100 |
Device is recycled |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20004 |
<Device CUID> |
<Operator ID> |
RequestRecycle |
301 |
Device recycle failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20007 |
<Device CUID> |
<Operator ID> |
Replace |
100 |
Replacement request is submitted |
GUI and CCMAPI |
0 |
0 |
<device type> |
<replacement reason>: “FORGOTTEN”, “STOLEN”, “LOST”, “DAMAGED” |
|
20007 |
<Device CUID> |
<Operator ID> |
Replace |
301 |
Replacement request failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
<replacement reason>: “FORGOTTEN”, “STOLEN”, “LOST”, “DAMAGED” |
|
20008 |
<Device CUID> |
<Operator ID> |
Resume |
100 |
Temporary device is cancelled Replacement request is cancelled Device is resumed after suspension |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20008 |
<Device CUID> |
<Operator ID> |
Resume |
301 |
Temporary device cancellation failed Replacement request cancellation failed Device could not be resumed after suspension |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20009 |
<Device CUID> |
<Operator ID> |
Terminate |
100 |
Device is terminated |
GUI and CCMAPI |
0 |
0 |
<device type> |
<Termination reason> |
|
20009 |
<Device CUID> |
<Operator ID> |
Terminate |
301 |
Device termination failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
<Termination reason> |
|
20010 |
<Device CUID> |
<Operator ID> |
VerifyUnlockPin |
100 |
User’s Emergency password The emergency password temporarily replaces an OTP (one-time password) where a user has either forgotten or lost his or her device. is verified at User Portal authentication |
GUI |
0 |
0 |
<device type> |
Null |
|
20010 |
<Device CUID> |
<Operator ID> |
VerifyUnlockPin |
301 |
User’s Emergency password verification failed |
GUI |
0 |
0 |
<device type> |
Null |
|
20011 |
<Device CUID> |
<Operator ID> |
GetUnlockCode |
100 |
Unlock code is generated (as response for a given challenge) |
GUI |
0 |
0 |
<device type> |
<Challenge code> |
|
20011 |
<Device CUID> |
<Operator ID> |
GetUnlockCode |
301 |
Unlock code generation failed |
GUI |
0 |
0 |
<device type> |
Null |
|
20013 |
<Device CUID> |
<Operator ID> |
BindDevice |
100 |
Device is bound to a user |
GUI and CCMAPI |
0 |
0 |
<device type> ;<policy name> |
User binding value |
|
20013 |
<Device CUID> |
<Operator ID> |
BindDevice |
301 |
Device could not be bound to a user |
GUI and CCMAPI |
0 |
0 |
<device type> + ";" + <policy name> |
User binding value |
|
20014 |
<Device CUID> |
<Operator ID> |
UnbindDevice |
100 |
Device is unbound from a user |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20014 |
<Device CUID> |
<Operator ID> |
UnbindDevice |
301 |
Device could not be unbound from a user |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20015 |
<Device CUID> |
<Operator ID> |
ResetActivationPIN |
100 |
Initial password is reset |
GUI |
0 |
0 |
<device type> |
Null |
|
20015 |
<Device CUID> |
<Operator ID> |
ResetActivationPIN |
301 |
Initial password could not be reset |
GUI |
0 |
0 |
<device type> |
Null |
|
20018 |
<Device CUID> |
<Operator ID> |
Hold |
100 |
Device is put on hold |
GUI and CCMAPI |
0 |
0 |
<device type> |
"ON_HOLD" |
|
20018 |
<Device CUID> |
<Operator ID> |
Hold |
301 |
Device could not be put on hold |
GUI and CCMAPI |
0 |
0 |
<device type> |
"ON_HOLD" |
|
20150 |
<Device CUID> |
<Operator ID> |
Activate |
100 |
Device is activated |
GUI and CCMAPI |
0 |
0 |
<device type> |
User binding value |
|
20150 |
<Device CUID> |
<Operator ID> |
Activate |
301 |
Device activation failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
User binding value |
|
20151 |
<Device CUID> |
<Operator ID> |
Synchronize |
100 |
Device is being synchronized |
GUI and CCMAPI |
<Request id> |
<Request type>(11) |
<device type>;<Request reason>(11) |
<Wallet id> |
|
20151 |
<Device CUID> |
<Operator ID> |
Synchronize |
301 |
Device synchronization failed |
GUI and CCMAPI |
<Request id> |
<Request type>(11) |
<device type>;<Request reason>(11) |
<Wallet id> |
|
20151 |
<Device CUID> |
<Operator ID> |
Synchronize |
500 |
Device synchronization succeeded |
GUI and CCMAPI |
<Request id> |
<Request type>(11) |
<device type>;<Request reason>(11) |
<Wallet id> |
(11) Request type / Request reason values – the Request type associated with the Request reason determines the Operation type as explained in the following table. The Request reason is appended to the device type in the Char1 field, separated with a semicolon (e.g., OP_2.0;NONE).
|
Operation type |
Request Type |
Request Reason |
|---|---|---|
|
Issuance |
64 |
"NONE" |
|
Temporary Replacement Issuance |
64 |
"FORGOTTEN" |
|
Permanent Replacement Issuance |
64 |
"LOST" or "STOLEN" or "DAMAGED" or "EXPIRED" |
|
Re-issuance |
64 |
"RENEW" |
|
Production |
128 |
"NONE" |
|
Temporary Replacement Production |
128 |
"FORGOTTEN" |
|
Permanent Replacement Production |
128 |
"LOST" or "STOLEN" or "DAMAGED" or "EXPIRED" |
|
Re-production |
128 |
"RENEW" |
|
Applications Update |
32 |
N/A |
|
PIN Unlock |
8 |
N/A |
|
Device Lock/Unlock |
256 |
N/A |
|
Recycle |
66 |
N/A |
Credential Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20016 |
<Device CUID> |
<Operator ID> |
RequestRemoveCredential |
100 |
Credential is removed from the device |
GUI and CCMAPI |
0 |
0 |
<device type> |
<application status> |
|
20016 |
<Device CUID> |
<Operator ID> |
RequestRemoveCredential |
301 |
Credential could not be removed from the device |
GUI and CCMAPI |
0 |
0 |
<device type> |
<application status> |
|
20017 |
<Device CUID> |
<Operator ID> |
RequestPostIssuance |
100 |
Application update is performed on a device |
GUI and CCMAPI |
0 |
0 |
<device type> |
<device policy> |
|
20017 |
<Device CUID> |
<Operator ID> |
RequestPostIssuance |
301 |
Application update failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
<device policy> |
|
20019 |
<Device CUID> |
<Operator ID> |
SKICredentialResync |
301 |
SKI credential could not be resynchronized Note: Only for ActivID AAA servers. |
GUI |
0 |
6 |
<User id> |
<device type> |
|
20110 |
<User id> |
<Operator ID> |
CertIssuance |
100 |
SKI Credential is being issued Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<device type> |
<device CUID> |
|
20110 |
<Device CUID> |
<Operator ID> |
CertIssuance |
100 |
PKI Credential is being issued Symantec v7 (VeriSign)) |
GUI and CCMAPI |
5 – Symantec v7 (VeriSign) |
0 |
Null |
<device type> |
|
20110 |
<User id> |
<Operator ID> |
CertIssuance |
301 |
SKI Credential could not be issued Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<device type> |
<device CUID> |
|
20110 |
<Device CUID> |
<Operator ID> |
CertIssuance |
301 |
Setting of SKI temporary password failed Note: Only for ActivID AAA servers. |
GUI |
0 |
6 |
<User id> |
<device type> |
|
20110 |
<Device CUID> |
<Operator ID> |
CertIssuance |
301 |
PKI Credential issuance failed (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
5 – Symantec v7 (VeriSign) |
0 |
Null |
<device type> |
|
20110 |
<User id> |
<Operator ID> |
CertIssuance |
500 |
SKI Credential issuance successfully completed Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<device type> |
<device CUID> |
|
20110 |
<Device CUID> |
<Operator ID> |
CertIssuance |
500 |
PKI Credential issuance successfully completed (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
5 – Symantec v7 (VeriSign) |
0 |
<cert subject> |
<device type>; |
|
20110 |
<Device CUID> |
<Operator ID> |
CertIssuance |
500 |
PKI Credential issuance successfully completed (Symantec v7 (VeriSign)) – Second event |
GUI and CCMAPI |
5 – Symantec v7 (VeriSign) |
0 |
<cert subject cn> |
<cert subject ou> |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
100 |
PKI credential is being revoked (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
301 |
PKI credential revocation failed (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
301 |
SKI credential revocation failed Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
301 |
SKI temporary password cancellation failed Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
6 |
<User id> |
<device type> |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
500 |
SKI credential revoked successfully Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20111 |
<Device CUID> |
<Operator ID> |
CertRevoke |
500 |
PKI credential revoked successfully (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20112 |
<Device CUID> |
<Operator ID> |
CertHold |
100 |
PKI credential is being put on hold (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20112 |
<Device CUID> |
<Operator ID> |
CertHold |
301 |
PKI credential could not be put on hold (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>;<cert serial number> |
|
20112 |
<Device CUID> |
<Operator ID> |
CertHold |
301 |
SKI credential could not be put on hold Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20112 |
<Device CUID> |
<Operator ID> |
CertHold |
500 |
SKI credential put on hold successfully Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20112 |
<Device CUID> |
<Operator ID> |
CertHold |
500 |
PKI credential put on hold successfully (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20113 |
<Device CUID> |
<Operator ID> |
CertResume |
100 |
PKI credential is being resumed (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20113 |
<Device CUID> |
<Operator ID> |
CertResume |
301 |
PKI credential could not be resumed (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20113 |
<Device CUID> |
<Operator ID> |
CertResume |
301 |
SKI credential could not be resumed Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20113 |
<Device CUID> |
<Operator ID> |
CertResume |
500 |
SKI credential resumed successfully Note: Only for ActivID AAA servers. |
GUI and CCMAPI |
0 |
1 |
<AAA server> |
<device type> |
|
20113 |
<Device CUID> |
<Operator ID> |
CertResume |
500 |
PKI credential resumed successfully (Symantec v7 (VeriSign)) |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<device type>; |
|
20202 |
<Device CUID> |
<Operator ID> |
CreateCredential |
100 |
Credential creation has been requested to a credential provider (event generated before requesting) Note: For PKI PKI describes the laws, policies, standards, and software that regulate or manipulate certificates and public and private keys., SKI Symmetric Key Infrastructure, and OATH Open Authentication credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20202 |
<Device CUID> |
<Operator ID> |
CreateCredential |
301 |
Credential creation by a credential provider failed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20202 |
<Device CUID> |
<Operator ID> |
CreateCredential |
500 |
Credential creation successfully completed by a credential provider Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20203 |
<Device CUID> |
<Operator ID> |
UpdateCredential |
100 |
Credential update has been requested to a credential provider (event generated before requesting) Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20203 |
<Device CUID> |
<Operator ID> |
UpdateCredential |
301 |
Credential update by a credential provider failed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>;<Cred profile id>; |
|
20203 |
<Device CUID> |
<Operator ID> |
UpdateCredential |
500 |
Credential update successfully completed by a credential provider Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20204 |
<Device CUID> |
<Operator ID> |
ProcessCredential |
100 |
Credential managed by a credential provider is being processed – suspended, resumed, revoked, etc. (the event is generated before the process is performed) Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
Null |
<Cred type>; |
|
20204 |
<Device CUID> |
<Operator ID> |
ProcessCredential |
301 |
Process performed on a credential by a credential provider failed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
Null |
<Cred type>; |
|
20204 |
<Device CUID> |
<Operator ID> |
ProcessCredential |
500 |
Process performed on a credential by a credential provider is successfully completed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
Null |
<Cred type>; |
|
20206 |
<Device CUID> |
<Operator ID> |
RollbackCredentialTransaction |
100 |
Rollback on the creation or update of a credential is being processed (event is generated before the process is performed) Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20206 |
<Device CUID> |
<Operator ID> |
RollbackCredentialTransaction |
301 |
Rollback on the creation or update of a credential failed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
|
20206 |
<Device CUID> |
<Operator ID> |
RollbackCredentialTransaction |
500 |
Rollback on the creation or update of a credential is successfully completed Note: For PKI, SKI, and OATH credential types (SKI and OATH only for ActivID Authentication Server). |
GUI and CCMAPI |
<Provider id> |
<Context id> |
<User id> |
<Cred type>; |
Request Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20001 |
Null |
<Operator ID> |
CancelRequest |
100 |
Request is cancelled – device Issuance request, application update request, re-issuance request, unlock request, or replacement request |
GUI and CCMAPI |
<Request ID> |
0 |
Null |
Null |
|
20001 |
Null |
<Operator ID> |
CancelRequest |
301 |
Request cancellation failed |
GUI and CCMAPI |
<Request ID> |
0 |
Null |
Null |
|
20005 |
<Device CUID> |
<Operator ID> |
RequestUnlock |
100 |
Unlock request is created |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20005 |
<Device CUID> |
<Operator ID> |
RequestUnlock |
301 |
Unlock request creation failed |
GUI and CCMAPI |
0 |
0 |
<device type> |
Null |
|
20061 |
Null |
<Operator ID> |
DeleteRequest |
100 |
Request is deleted by the system after the request is successfully executed – Unlock, Application update, Re-issuance, or Replacement request |
GUI and CCMAPI |
<Req Sequence ID> |
0 |
Null |
Null |
|
20061 |
Null |
<Operator ID> |
DeleteRequest |
301 |
Request could not be deleted by the system after the request is successfully executed – Unlock, Application update, Re-issuance, or Replacement request |
GUI and CCMAPI |
<Req Sequence ID> |
0 |
Null |
Null |
|
20062 |
Null |
<Operator ID> |
ApproveRequest |
100 |
Request is being approved - Temporary replacement, Permanent replacement, or Validated issuance request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
<approved by> |
<User binding value> |
|
20062 |
Null |
<Operator ID> |
ApproveRequest |
301 |
Request could not be approved - Temporary replacement, Permanent replacement, or Validated issuance request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
<approved by> |
<User binding value> |
|
20063 |
Null |
<Operator ID> |
DenyRequest |
100 |
Request is being denied - Temporary replacement, Permanent replacement, or Validated issuance request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
|
20063 |
Null |
<Operator ID> |
DenyRequest |
301 |
Request could not be denied - Temporary replacement, Permanent replacement, or Validated issuance request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
|
20064 |
Null |
<Operator ID> |
WriteRequest |
100 |
Request is being created or updated - Temporary replacement, Permanent replacement, Re-issuance, Validated issuance, Unlock, Application update, Recycle, or Production request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
|
20064 |
Null |
<Operator ID> |
WriteRequest |
301 |
Request could not be created or updated - Temporary replacement, Permanent replacement, Re-issuance, Validated issuance, Unlock, Application update, Recycle, or Production request |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
|
20066 |
Null |
<Operator ID> |
MakeRequestReady |
100 |
Replacement request is being updated after the device is bound to the user |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
|
20066 |
Null |
<Operator ID> |
MakeRequestReady |
301 |
Replacement request could not be updated after the device is bound to the user |
GUI and CCMAPI |
<Req Sequence ID> |
<Request type> |
Null |
<User binding value> |
User Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20041 |
Null |
<Operator ID> |
DeleteOperator |
100 |
Operator is being deleted |
GUI |
0 |
0 |
<Operator cert subject> |
Null |
|
20041 |
Null |
<Operator ID> |
DeleteOperator |
301 |
Operator could not be deleted |
GUI |
0 |
0 |
<Operator cert subject> |
Null |
|
20042 |
Null |
<Operator ID> |
WriteOperator |
100 |
New operator is being created, or existing operator is being updated |
GUI |
0 |
0 |
<Operator cert subject> |
Null |
|
20042 |
Null |
<Operator ID> |
WriteOperator |
301 |
New operator could not be created, or existing operator could not be updated |
GUI |
0 |
0 |
<Operator cert subject> |
Null |
|
20044 |
Null |
<Operator ID> |
LogonSSL |
100 |
Operator is logging in the Operator portal |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
Null |
|
20044 |
Null |
<Operator ID> |
LogonSSL |
301 |
Operator failed to log in the Operator portal |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
Null |
|
20044 |
Null |
<Operator ID> |
LogonSSL |
500 |
Operator has successfully logged in the Operator portal |
GUI and CCMAPI |
0 |
0 |
<cert subject> |
<Operator cert subject>;<role name> |
|
20070 |
Null |
<Operator ID> |
CreateUser |
100 |
User is being created in LDAP Lightweight Directory Access Protocol directory |
GUI and CCMAPI |
0 |
0 |
<parent dn> |
Null |
|
20070 |
Null |
<Operator ID> |
CreateUser |
301 |
User could not be created in LDAP directory |
GUI and CCMAPI |
0 |
0 |
<parent dn> |
Null |
|
20071 |
Null |
<Operator ID> |
DeleteUser |
100 |
User is being deleted in LDAP directory |
GUI and CCMAPI |
0 |
0 |
<user dn> |
Null |
|
20071 |
Null |
<Operator ID> |
DeleteUser |
301 |
User could not be deleted in LDAP directory |
GUI and CCMAPI |
0 |
0 |
<user dn> |
Null |
|
20140 |
Null |
<Operator ID> |
UsersGroupAdd |
100 |
Users group is being created |
GUI |
0 |
0 |
<users group name> |
Null |
|
20140 |
Null |
<Operator ID> |
UsersGroupAdd |
301 |
Users group could not be created |
GUI |
0 |
0 |
<users group name> |
Null |
|
20141 |
Null |
<Operator ID> |
UsersGroupRemove |
100 |
Users group is being deleted |
GUI |
0 |
0 |
<users group name> |
Null |
|
20141 |
Null |
<Operator ID> |
UsersGroupRemove |
301 |
Users group could not be deleted |
GUI |
0 |
0 |
<users group name> |
Null |
|
20142 |
Null |
<Operator ID> |
UsersGroupUpdate |
100 |
Users group is being updated |
GUI |
0 |
0 |
<users group name> |
Null |
|
20142 |
Null |
<Operator ID> |
UsersGroupUpdate |
301 |
Users group could not be updated |
GUI |
0 |
0 |
<users group name> |
Null |
|
20160 |
<User id> |
<Operator ID> |
InvokePlugins |
100 |
Generic plug-in is being invoked (event generated before invoking) |
GUI |
0 |
0 – server plugin 1 – client plugin |
Null |
<Step name> |
|
20160 |
<User id> |
<Operator ID> |
InvokePlugins |
301 |
Generic plug-in has been invoked (event generated after invoking) and invocation generated an error |
GUI |
0 |
0 – server plugin 1 – client plugin |
<error message> |
<Step name>;<Error source> |
The REST Representational State TransferAPI In the context of ActivID CMS, an Application Programming Interface (API) is an external interface (for example, the CCM API) that makes it possible for applications not supported by HID Global to incorporate ActivID functionality. events do not use Num1 and Num2 (which are always 0). Instead, they use the errorNumber and errorMessage fields to provide detailed information on failures (especially, authentication failures).
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
errorNumber |
errorMessage |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20500 |
Null |
<Operator ID> |
REST API Token |
100 |
Operator is logging in to the REST API |
REST API |
0 |
Null |
<cert subject> |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
301 |
An error occurred while authenticating |
REST API |
1: general error |
One of: - HTTP error - Invalid HTTP request - Login error |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid bearer grant |
REST API |
100 |
Invalid bearer grant |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid scope |
REST API |
101 |
Invalid scope |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid token |
REST API |
102 |
One of: - Missing token - Invalid token |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid algorithm |
REST API |
103 |
Invalid algorithm |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid key |
REST API |
104 |
Invalid key |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid subject |
REST API |
105 |
Invalid subject |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid operator |
REST API |
106 |
One of: - Operator not found - Operator not active |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid token signature |
REST API |
107 |
One of: - Operator without certificate - Operator certificate is invalid - Operator certificate mismatch - Signature verification failed |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid audience |
REST API |
108 |
Missing or invalid audience |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: invalid expiration date |
REST API |
109 |
Missing or invalid expiration date |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: missing mandatory token field |
REST API |
110 |
One of: - Missing token field: iss - Missing token field: sub - Missing token field: jtit |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> if available, Null otherwise |
REST API Token |
601 |
Operator failed to log in to the REST API: token id reuse |
REST API |
111 |
Token id reuse before expiration |
<cert subject> if available; Null otherwise |
Null |
|
20500 |
Null |
<Operator ID> |
REST API Token |
500 |
Operator has successfully logged in to the REST API |
REST API |
0 |
Null |
<cert subject> |
<Operator cert subject>;<role name> |
|
20501 |
Null |
<Operator ID> if available, Null otherwise |
REST API Revoke |
301 |
Operator failed to log out of the Operator portal |
REST API |
1: general error |
Revoke error |
<cert subject> if available; Null otherwise |
Null |
|
20501 |
Null |
<Operator ID> |
REST API Revoke |
500 |
Operator has successfully logged out of the Operator portal |
REST API |
0 |
Null |
<cert subject> |
Null |
|
20511 |
Null |
<Operator ID> |
REST API SCIM User POST |
100 |
Operator is creating a new operator. Note: 20070 may be audited with more details |
REST API |
0 |
Null |
Null |
Null |
|
20511 |
Null |
<Operator ID> |
REST API SCIM User POST |
301 |
Operator could not create a new operator. |
REST API |
0 |
Null |
Null |
Null |
|
20511 |
Null |
<Operator ID> |
REST API SCIM User POST |
601 |
Access token is invalid |
REST API |
0 |
Null |
Null |
Null |
|
20511 |
Null |
<Operator ID> |
REST API SCIM User POST |
500 |
Operator successfully created a new operator |
REST API |
0 |
Null |
Null |
Null |
|
20512 |
Null |
<Operator ID> |
REST API SCIM User PUT |
Reserved for future usage |
||||||
|
20513 |
Null |
Null |
REST API SCIM User GET |
301 |
Operator unsuccessfully tried to search users (authentication error) |
REST API |
0 |
Null |
Null |
Null |
|
20513 |
Null |
<Operator ID> |
REST API SCIM User GET |
301 |
Operator unsuccessfully tried to search users (for example, authorization error) |
REST API |
0 |
Null |
Null |
Null |
|
20513 |
Null |
<Operator ID> |
REST API SCIM User GET |
601 |
Access token is invalid |
REST API |
0 |
Null |
Null |
Null |
|
20514 |
Null |
<Operator ID> |
REST API SCIM User DELETE |
100 |
Operator is deleting an operator Note: 20071 may also be audited with more details |
REST API |
0 |
Null |
Null |
Null |
|
20514 |
Null |
<Operator ID> |
REST API SCIM User DELETE |
301 |
Operator could not delete an operator |
REST API |
0 |
Null |
Null |
Null |
|
20514 |
Null |
<Operator ID> |
REST API SCIM User DELETE |
601 |
Access token is invalid |
REST API |
0 |
Null |
Null |
Null |
|
20514 |
Null |
<Operator ID> |
REST API SCIM User DELETE |
500 |
Operator successfully deleted an operator |
REST API |
0 |
Null |
Null |
Null |
Policy Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20024 |
Null |
<Operator ID> |
WriteDevicePolicy |
100 |
New device policy created, or existing device policy updated |
GUI |
0 |
0 |
<device policy> |
Null |
|
20024 |
Null |
<Operator ID> |
WriteDevicePolicy |
301 |
New device policy could not be created, or existing device policy could not be updated |
GUI |
0 |
0 |
<device policy> |
Null |
|
20025 |
Null |
<Operator ID> |
DeleteDevicePolicy |
100 |
Device policy is being deleted |
GUI |
0 |
0 |
<device policy> |
Null |
|
20025 |
Null |
<Operator ID> |
DeleteDevicePolicy |
301 |
Device policy could not be deleted |
GUI |
0 |
0 |
<device policy> |
Null |
|
20032 |
Null |
<Operator ID> |
WriteEnrollmentPolicy |
100 |
Device policy assignment is being created or updated |
GUI |
0 |
0 |
<assignment name> |
Null |
|
20032 |
Null |
<Operator ID> |
WriteEnrollmentPolicy |
301 |
Device policy assignment could not be created or updated |
GUI |
0 |
0 |
<assignment name> |
Null |
|
20033 |
Null |
<Operator ID> |
DeleteEnrollmentPolicy |
100 |
Device policy assignment is being deleted |
GUI |
0 |
0 |
<assignment name> |
Null |
|
20033 |
Null |
<Operator ID> |
DeleteEnrollmentPolicy |
301 |
Device policy assignment could not be deleted |
GUI |
0 |
0 |
<assignment name> |
Null |
User Portal Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20130 |
<Device CUID> |
Null |
LockAccount |
100 |
User access to User Portal is locked by giving: Too many wrong initial passwords Too many wrong emergency passwords |
GUI |
0 |
0 |
<device type> |
Null |
|
20131 |
<Device CUID> |
Null |
AuthenticateUser |
100 |
User is logging in User Portal |
GUI |
<Authentication type>(12) |
<Remaining authentication tries> |
<User id> |
FIPS196 authentication– <Serial number of certificate used for signature> |
|
20131 |
<Device CUID> |
Null |
AuthenticateUser |
301 |
User authentication to User Portal failed |
GUI |
<Authentication type>(12) |
<Remaining authentication tries> |
<User id> |
FIPS196 authentication– <Serial number of certificate used for signature> |
|
20131 |
<Device CUID> |
Null |
AuthenticateUser |
500 |
User has successfully logged on User Portal |
GUI |
<Authentication type>(12) |
<Remaining authentication tries> |
<User id> |
FIPS196 authentication– <Serial number of certificate used for signature> |
(12) Authentication type values:
-
- 1 – Not performed
-
0 – PIN
-
1 – LDAP password
-
2 – Emergency password
-
3 – Security Questions
-
4 – Initial Password
-
5 – FIPS 196
Repository Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20080 |
Null |
<Operator ID> |
SaveLDAPInfo |
100 |
New directory is being created, or existing directory is being updated or deleted |
GUI |
0 |
0 |
Null |
Null |
|
20080 |
Null |
<Operator ID> |
SaveLDAPInfo |
301 |
New directory could not be created, or existing directory could not be updated or deleted |
GUI |
0 |
0 |
Null |
Null |
|
20100 |
Null |
<Operator ID> |
SaveAAA |
100 |
New AAA server is being created, or existing AAA server is being updated or deleted |
GUI |
0 |
0 |
Null |
Null |
|
20100 |
Null |
<Operator ID> |
SaveAAA |
301 |
New AAA server could not be created, or existing AAA server could not be updated or deleted |
GUI |
0 |
0 |
Null |
Null |
|
20200 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
100 |
New Credential Provider is being created (either PKI, or ActivID Application Server) |
GUI |
<Provider id> |
-1 |
|
|
|
20200 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
100 |
New Credential Provider is being updated (either PKI, or ActivID Application Server) |
GUI |
<Provider id> |
<Context id> |
|
|
|
20200 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
500 |
New Credential Provider has been successfully created or updated |
GUI |
<Provider id> |
<Context id> |
|
|
|
20200 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
301 |
New Credential Provider could not be created |
GUI |
<Provider id> |
-1 |
|
|
|
20200 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
301 |
New Credential Provider could not be updated |
GUI |
<Provider id> |
<Context id> |
|
|
|
20201 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
100 |
New Credential Provider is being removed (either PKI, or ActivID Application Server) |
GUI |
<Provider id> |
<Context id> |
|
|
|
20201 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
500 |
New Credential Provider has been successfully removed |
GUI |
<Provider id> |
<Context id> |
|
|
|
20201 |
Null |
<Operator ID> |
InitializeCredentialProviderContext |
301 |
New Credential Provider could not be removed |
GUI |
<Provider id> |
<Context id> |
|
|
Audit Maintenance Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
20400 |
Null |
Check7Days |
PIV_7daysCheck |
100 |
PIV Check-7-days is started(13) |
GUI |
0 |
0 |
Null |
Null |
|
20400 |
Null |
Check7Days |
PIV_7daysCheck |
301 |
PIV Check-7-days failed. |
GUI |
0 |
0 |
Null |
Null |
|
20400 |
Null |
Check7Days |
PIV_7daysCheck |
500 |
PIV Check-7-days is completed successfully. |
GUI |
0 |
0 |
Null |
Null |
(13) The PIV Check-7-days is run at 1:00 a.m. local time of the machine where ActivID CMS is installed.
Audit Management Events
|
Event ID |
Client ID |
Operator ID |
Event Description |
Event Severity Level |
Event is generated when… |
GUI / CCM API |
Num1 |
Num2 |
Char1 |
Char2 |
|---|---|---|---|---|---|---|---|---|---|---|
|
8000 |
Null |
Null |
AuditServerStart |
100 |
ActivID CMS Server is started |
GUI |
0 |
0 |
Null |
Null |
