Deployment Group Settings Auditing

The Auditing tab in the Deployment Group > Setting node allows you to specify which events client computers send to the Management Server for each product agent. You can also select to display user and computer names in events anonymously.

Events can be generated for all products, click on a product to see the Event IDs and Descriptions.

Application Control

Event ID	Event Name	Event Description	Event Log Type
9000	Denied Execution	Prohibited execution request.	Warning
9001	Allowed Execution	Allowed execution request.	Information
9002	Overwrite Changed Owner	Overwrite of an allowed executable.	Warning
9003	Rename Changed Owner	Rename of a prohibited executable.	Warning
9004	Application Limit Denial	Application limit denial.	Warning
9005	Time Limit Denial	Time limit denial.	Warning
9006	Self-Authorization	Self-authorization decision by user.	Warning
9007	Self-Authorized allow	Self-authorization execution request.	Warning
9009	Scripted Rule Timeout	Script execution timed out.	Warning
9010	Scripted Rule Fail	Script failed to complete.	Warning
9011	Scripted Rule Success	Script completed successfully	Information
9012	Trusted Vendor Denial	Digital Certificate failed Trusted Vendor check.	Warning
9013	Network Item denied	Prohibited Network Item request.	Warning
9014	Network Item allowed	Allowed Network Item request.	Information
9015	Application Started	An allowed application started running.	Information
9016	Unable to Change Ownership	The file's ownership could not be changed.	Error
9017	Application Termination	A prohibited application has been terminated by Application Control.	Information
9018	Application User Rights Changed	The application's user rights have changed.	Information
9019	AM allowed install	Allowed web Installation request.	Information
9020	AM restricted install	Restricted web installation request.	Information
9021	Windows restricted install (Basic Discovery Mode)	Windows restricted web installation request.	Information
9022	Web Installation Fail	Web installation failed to complete	Warning
9023	Self-Elevation	Self-Elevation request	Information
9024	URL Redirection	URL Redirection has occurred.	Information
9051	Policy Change granted	A Policy Change Request has been granted	Information
9052	Policy Change invalid response code	An invalid response code has been entered for a Policy Change request	Error
9053	User-requested allow	An allowed Policy Change application has started	Information
9054	User-requested elevate	An elevated Policy Change application has started	Information
9055	Service start/stop	A service has been started or stopped	Information
9056	Untrusted file with metadata match	Failed to verify the certificate of a signed file when matching metadata.	Information
9060	Denied execution (Trusted Ownership)	Denied execution request (Trusted Ownership)	Information
9061	Denied execution (Rule Policy)	Denied execution request (Rule Policy)	Information
9062	Admin process started event	An application started with elevated (full administrator) rights.	Information
9096	Configuration merge success	The configuration merge has completed successfully	Information
9097	Configuration merge fail	The configuration merge has failed	Error
9098	Configuration merge timeout	The configuration merge is still waiting for expected files	Warning
9099	Agent not licensed	Ivanti Application Control is not licensed.	Error

Environment Manager

Event ID	Event Name	Event Description	Event Log Type
9300	Self healing process started	A process being monitored for self healing stopped and has been restarted.	Information
9301	Self healing registry key replaced	A registry key being monitored for self healing was changed and has now been reset.	Information
9302	Self healing registry key removed	A registry key being monitored for self healing was inserted and has now been removed.	Information
9303	Self healing file replaced	A file being monitored for self healing was modified or removed and has now been replaced.	Information
9304	Self healing file removed	A file being monitored for self healing was added and has now been removed.	Information
9305	Self healing service stopped	A service being monitored for self healing started and has now been stopped.	Information
9306	Self healing service started	A service being monitored for self healing stopped and has now been restarted.	Information
9307	Self healing registry value replaced	A registry value being monitored for self healing was changed and has now been reset.	Information
9308	Self healing registry removed	A registry value being monitored for self healing was inserted and has now been removed.	Information
9399	Software is not licensed	The Environment Manager software has not been licensed.	Error
9400	Lockdown edit control blocked drive	An edit control has had a blocked drive entered into it.	Information
9401	Lockdown edit control blocked text	An edit control has had blocked text entered into it.	Information
9402	Lockdown accelerator keys blocked	An application has had accelerator keys blocked.	Information
9403	Lockdown dialog blocked	An application has had a dialog box blocked.	Information
9404	Lockdown	An application has had access blocked for a control using MSAA detection.	Information
9405	User logon action success	A user logon action completed successfully.	Information
9406	User logon action fail	A user logon action failed to complete successfully.	Error
9407	User logoff action success	A user logoff action completed successfully.	Information
9408	User logoff action fail	A user logoff action failed to complete successfully.	Warning
9409	Computer startup action success	A computer startup action completed successfully.	Information
9410	Computer startup action fail	A computer startup action failed to complete successfully.	Warning
9413	Computer network available	A computer network available action completed successfully.	Information
9414	Computer network available action fail	A computer network available action failed to complete successfully.	Information
9420	User session reconnect action success	A user session reconnect action completed successfully.	Information
9421	User session reconnect action fail	A user session reconnect action failed to complete successfully.	Warning
9422	User session disconnect action success	A user session disconnect action completed successfully.	Information
9423	User session disconnect action fail	A user session disconnect action failed to complete successfully.	Warning
9424	User session locked action success	A user session locked action completed successfully.	Information
9425	User session locked action fail	A user session action failed to complete successfully.	Warning
9426	User session unlocked action success	A user session unlocked action completed successfully.	Information
9427	User session unlocked action fail	A user session unlocked action failed to complete successfully.	Warning
9428	Process start action success	A process start action completed successfully.	Information
9429	Process start action fail	A process start action failed to complete successfully.	Warning
9430	Process stopped action success	A process stopped action completed successfully.	Information
9431	Process stopped action fail	A process stopped action failed to complete successfully.	Warning
9432	Network connection action success	A network connected action completed successfully.	Information
9433	Network connection action fail	A network connected action failed to complete successfully	Warning
9434	Network disconnected action success	A network disconnected action completed successfully.	Information
9435	Network disconnected action fail	A network disconnected action failed to complete successfully.	Warning
9436	User logon (pre-session) action success	A user logon (pre-session) action completed successfully.	Information
9437	User logon (pre-session) action fail	A user logon (pre-session) action failed to complete successfully.	Information
9438	User logon (pre-desktop) action success	A user logon (pre-desktop) action completed successfully.	Information
9439	User logon (pre-desktop) action fail	A user logon (pre-desktop) action failed to complete successfully.	Information
9440	User logon (desktop created) action success	A user logon (desktop created) action completed successfully.	Information
9441	User logon (desktop created) action fail	A user logon (desktop created) action failed to complete successfully.	Information
9442	Scheduled node action success	A scheduled node action completed successfully	Information
9443	Scheduled node action fail	A scheduled node action failed to complete successfully	Information
9480	Configuration merge update	The configuration merge folder has been updated.	Information
9481	Configuration merge start	The configuration merge has started.	Information
9482	Configuration merge complete	The configuration merge has completed successfully.	Information
9483	Configuration merge fail	The configuration merge has failed.	Information
9484	Configuration merge timeout	The configuration merge has timed out waiting for expected files.	Information
9495	Not configured	Ivanti Environment Manager has not been configured.	Warning
9496	Configuration unsupported	An old configuration has been found.	Warning
9650	Managed application start	A managed application has started	Information
9651	Managed application stop	A managed application has stopped	Information
9652	Personalization load error	Personalization settings for a managed application failed to load.	Error
9653	Personalization save error	Personalization settings for a managed application failed to save.	Error
9654	Blocklisted process started	A managed process has launched a blocklisted process.	Information
9655	Personalization not saved	Personalization settings not saved as another group application is running.	Information
9656	Offline resiliency save started	Offline resiliency save has been started for a managed application.	Information
9657	Offline resiliency save complete	Offline resiliency has successfully saved a managed application’s personalization settings.	Information
9658	Personalization settings purged	Personalization settings purged as offline mode is disabled.	Information
9659	Personalization settings updated	User personalization settings updated from personalization server.	Information
9660	Personalization failed	Personalization for a managed application failed.	Error
9661	Timeout Communicating with Personalization Server	A timeout occurred while trying to communicate with the Personalization Server.	Warning
9662	Trigger Action Times	All the actions have run for the trigger.	Information
9663	PreCache Application Success	Successfully Precached Managed Application.	Information
9664	PreCache Group Success	Successfully PreCached Managed Application Group.	Information
9665	PreCache Managed Application Failure	Failed to PreCached Managed Application.	Error
9666	PreCache Group Failure	Failed to PreCached Managed Application Group.	Error
9667	Personalization Profile Import	A Profile Import is Active.	Information
9672	Action success	The automated action has completed successfully.	Information
9673	Action fail	The automated action has failed to complete.	Error
9680	Endpoint of Self Service start failure	The Endpoint Self-Service process failed to start.	Error
9690	Password Certificate Failure	The password for certification has failed.	Error
9691	Run As Failure	The Run As action has failed.	Error

Performance Manager

Event ID	Event Name	Event Description	Event Log Type
9100	User Memory Usage Warning	Amount of memory consumed by a user has exceeded a warning level set in a User Memory Limit.	Information
9101	User memory usage warning lapsed	Amount of memory consumed by a user has fallen back to a safe level as defined in a User Memory Limit.	Information
9102	User memory usage blocked	Amount of memory available to this user as defined in a User Memory rule has been exceeded. No more memory allocation will be allowed.	Warning
9103	User memory usage blocking lapsed	Amount of memory consumed by a user has fallen back to a safe (non-blocked) level as defined in a User Memory Limit.	Information
9104	Thread Throttling Clamping On	Total CPU Usage has exceeded a threshold and will be clamped.	Information
9105	Thread Throttling Clamping Off	Total CPU Usage has fallen under a threshold and clamping will stop.	Information
9106	Application CPU Usage clamping On	An Application has exceeded its configured hard CPU Usage limit and will be limited to that configured limit.	Information
9107	Per Application Memory Usage Exceeded	Memory usage for a particular application has exceeded a threshold.	Information
9108	Per Application Memory Usage Reduced	Memory usage for a particular application has dropped below a threshold.	Information
9109	Per Application Memory Usage Terminated	An application has been terminated because it used too much memory.	Warning
9110	Application CPU Usage Clamping Off	An application has now fallen below its CPU Usage limit and will no longer be clamped.	Information
9115	Working set trimmed	Working set for an application has been trimmed.	Information
9116	CPU Affinity changed	CPU Affinity of an application has changed.	Information
9119	Per Application Hard Memory Limit Reached	Memory usage for an application reached its hard memory limit	Warning
9120	Thread Throttling - Clamped Processes	Total CPU Usage has exceeded a threshold and applications will be clamped.	Information
9121	Application CPU Soft Limit - Started	Because of the overall CPU Usage a CPU soft limit will be applied to an application.	Information
9122	Application CPU Soft Limit - Stopped	An application will be no longer controlled by an CPU soft limit.	Information
9123	Application CPU Reservation Applied	A CPU Usage reservation was applied to an application.	Information
9124	Disk - Process I/O Queued	One or more processes were subject to I/O queuing.	Information
9150	Windows Performance Counter Error	The Windows performance counters on this machine are missing or broken.	Error
9170	Settings not found in package	Some configuration settings were not found in the configuration package.	Error
9171	Settings not valid in package	Some configuration settings in the configuration package were not valid.	Error
9172	Settings loaded from package	The configuration settings were successfully loaded from the configuration package.	Information
9173	Settings applied live to the Agent	The configuration settings were applied live to a running Performance Manager Agent.	Information
9174	Package has been loaded and all settings applied	All settings in the package have been applied to the Agent.	Information
9175	The package is invalid	The configuration package is invalid.	Error
9176	Package not found	The configuration package does not exist.	Warning
9197	Valid License Found	Performance Manager is licensed.	Information
9198	Invalid License Found	Performance Manager has detected a product license which is not compatible with the current used Performance Manager version. Use the Licensing Console to upgrade your Performance Manager license.	Error
9199	Valid License Not Found	Performance Manager is not licensed.	Error
9200	Application Analyzed	Memory Optimizer has analyzed a known application.	Information
9201	Component Analyzed	Memory Optimizer has analyzed a known component.	Information
9202	Component Optimized	Memory Optimizer has optimized a known component.	Information
9203	Component failed to Optimize	Performance Manager has failed to optimize a component	Warning
9204	Application Identified At Runtime	Memory Optimizer has analyzed a running process and added a new application to the optimization database.	Information
9205	Component Identified At Runtime	Memory Optimizer has analyzed a loaded component in a process and added it to the optimization database.	Information
9206	Database Analyzed	Memory Optimizer has analyzed all known applications within the optimization database.	Information
9207	Database Optimized	Memory Optimizer has optimized all known applications within the optimization database.	Information
9208	Application Optimized	Memory Optimizer has optimized a known application.	Information
9209	Database Cleaned	Memory Optimizer has cleaned the optimization database.	Information
9210	Application Cleaned	Memory Optimizer has cleaned a known application.	Information
9211	Component Cleaned	Memory Optimizer has cleaned a known component.	Information
9212	Out Of Memory	Memory Optimizer has run out of memory and cannot rebase any more	Error
9216	Statistics Collection Strategy	Details of the statistics configuration.	Information
9217	Invalid Local Database Folder	The local statistics database folder is invalid.	Error
9218	General Local Statistics Service Error	An error occurred in the Local Statistics Service.	Error
9219	Disk Cleanup Started	Started cleaning up the local statistics database folder.	Information
9220	Disk Cleanup of Single Database	Deleted a single old local database.	Information
9221	Disk Cleanup Complete	Started cleaning up the local statistics database folder.	Information
9222	Consolidation Search Started	Started searching for databases to consolidate.	Information
9223	Single File Consolidation Started	Started to transfer a local statistics database for consolidation.	Information
9224	Single File Consolidation Completed	Completed the transfer of a local statistics database for consolidation.	Information
9225	Consolidation Search Completed	Finished searching for databases to consolidate.	Information
9226	Statistics Scheduled Collection	Statistics collection is now scheduled at a new collection level.	Information
9228	Database Import Failed	An incoming database could not be imported.	Error
9229	Database Connection Failed	Could not connect to the configured Reporting Database.	Error
9230	Disk Cleanup Started	Started searching for old received databases to delete.	Information
9231	Disk Cleanup Completed	Finished searching for old received databases to delete.	Information
9232	Purge of Reporting Database Started	Started purging the Reporting Database.	Information
9233	Purge of Reporting Database Completed	Finished purging the Reporting Database.	Information
9234	Error in Central Statistics Server	An error occurred in the Central Statistics Service.	Information
9235	Deployment Agent updated native configuration	Detected Deployment Agent has updated the endpoint native configuration path.	Information
9236	Memory exceeded minimum threshold new processes eligible for memory limitations	The system memory has exceeded the minimum threshold. New processes will be eligible for memory limitations.	Information
9237	Memory exceeded minimum threshold	The system memory has fallen back below the minimum threshold. New processes will not be monitored for memory limitations.	Information

Management Center

Event ID	Event Name	Event Description	Event Log Type
9090	Service Ended Unexpectedly (Application Control)	The Application Control Agent has ended unexpectedly.	Information
9091	Service Restarted (Application Control)	The Application Control Agent has restarted.	Information
9092	Service Terminated (Application Control)	The Application Control Agent has been terminated due to being in the starting or stopping state for a prolonged period.	Information
9093	Service Unrecoverable (Application Control)	The Application Control Agent has exceeded the maximum restart attempts.	Information
9190	Service Ended Unexpectedly (Performance Manager)	The Performance Manager Agent has ended unexpectedly.	Information
9191	Service Restarted (Performance Manager)	The Performance Manager Agent has restarted.	Information
9192	Service Terminated (Performance Manager)	The Performance Manager Agent has been terminated due to being in the starting or stopping state for a prolonged period.	Information
9193	Service Unrecoverable (Performance Manager)	The Performance Manager Agent has exceeded the maximum restart attempts.	Information
9390	Service Ended Unexpectedly (Environment Manager)	The Environment Manager User Virtualization Service ended unexpectedly.	Information
9391	Service Restarted (Environment Manager)	The Environment Manager User Virtualization Service has restarted.	Information
9392	Service Terminated (Environment Manager)	The Environment Manager User Virtualization Service has been terminated due to being in the starting or stopping state for a prolonged period.	Information
9393	Service Unrecoverable (Environment Manager)	The Environment Manager User Virtualization Service has exceeded the maximum restart.	Information
9700	Action Notification Success	An action notification was dispatched successfully.	Information
9701	Action Notification Failure	An action notification has failed to dispatch.	Information
9702	Package Modified	Package created, modified or deleted.	Information
9703	User Modified	A user was created, modified or deleted.	Information
9704	Priority Event Failure	A priority event failed to upload to the Management Server.	Information
9705	Event Upload Failure	One or more events failed to upload to the Management Server.	Information
9707	Events Purged.	Events within the Management Server were deleted.	Information
9708	Platform Mismatch Package	Product agent is not compatible with client platform.	Information
9710	Package Installation Success	A package has been installed or uninstalled successfully by the Deployment Agent.	Information
9711	Package Installation Failure	A package has been unsuccessfully installed or uninstalled by the Deployment Agent.	Information
9712	Computer Registration	A computer has been assigned to a deployment group.	Information
9713	Failover Change URL	The Deployment Agent reverted to another Management Server due to connectivity problems.	Information
9715	Computer Self-registration	A computer has self registered with a deployment group.	Information
9716	Computer Self-registration Failed	A computer has failed to self-register with a deployment group.	Information
9718	Deployment Agent Installed License	The Deployment Agent installed a license.	Information
9720	BITS Server Extensions Not Installed	The Events Dispatcher service could not detect that BITS Server Extensions was installed.	Information
9730	Prerequisite Failed Check	A prerequisite failed due to 'fail-if' check.	Information
9731	Prerequisite Failed to Install	A prerequisite failed to install.	Information
9732	RPC Access Denied	Blocked endpoint request by the user (not running as an Administrator)	Warning
9733	RPC Set Deployment URL and Group Name	Administrator endpoint request to set Deployment Server URL and optional Group Name	Information
9734	RPC Update Agents	Administrator endpoint request to update all local agents.	Information
9735	RPC Update Configs	Administrator endpoint request to update all local configurations	Information
9736	RPC Query Updating Status	Administrator endpoint request to query update status for agent and configurations	Information
9737	RPC Image Prep	Administrator endpoint request for Image Prep	Information
9738	RPC Unregister	Administrator endpoint request to unregister from the Management Server.	Information
9740	Security Role Modified	A security role was created, modified, or deleted.	Information
9743	Computer self unregistration	A computer has unregistered from a deployment group.	Information
9744	Computer self unregistration failed	A computer has failed to unregister from the deployment group.	Information
9745	SQL AlwaysOn Failover	A SQL/Network error has occurred.	Information
9750	Deployment Agent HTTP error	The Deployment Agent failed to contact to the Management Server.	Information
9751	Deployment Agent registration	The Deployment Agent registered with the server.	Information
9752	Deployment Agent joined group	The Deployment Agent joined its assigned deployment group.	Information
9754	Deployment Agent Diagnostics Test	The Deployment Agent ran a diagnostics test on a server.	Information
9755	BITS Error	BITS Error.	Error
9756	Deployment Agent BITS Service Error	The Deployment Agent identified an error with the BITS service. The service cannot be started, either because the service it is disabled or because it has no enabled devices associated with it.	Error
9760	Deployment Agent Deployed Successfully	The Deployment Agent has been successfully deployed to a discovered machine.	Information
9761	Deployment Agent Deployment Failure	The Deployment Agent has failed to deploy to a discovered machine.	Information
9790	Service ended unexpectedly	The Deployment Agent has ended unexpectedly.	Information
9791	Service restarted	The Deployment Agent has restarted.	Information
9792	Service terminated	The Deployment Agent has been terminated due to being in the starting or stopping state for a prolonged period.	Information
9793	Service unrecoverable	The Deployment Agent has exceeded its maximum restart attempts.	Information
9795	Condition Modified	A deployment group condition has been modified. This may affect which computers get assigned to the deployment group.	Information

File Director

ID	Name	Type	Description
9800	Driver initialization failure	Error	An error occurs during driver initialization.
9801	Logging initialization failure	Error	An error occurs during logging initialization.
9802	Mapped drive processing failure	Error	An error occurs while processing mapped drive configuration.
9803	Dirty block information missing	Error	Conflicting dirty-block information has been detected for a file.
9804	Process parse tree failure	Error	An error occurs while generating the parse tree for a process.
9805	Conflict file fail	Error	A user-defined conflict format string was detected as being invalid.
9806	Server-side deletion success	Information	A server-side deletion succeeds.
9807	Server-side deletion success with status	Information	A server-side deletion succeeds – provides some additional status information when available.
9808	PST link failure	Error	An unlinked PST file fails to re-link back to Outlook profile.
9809	PST link success	Information	An unlinked PST file is successfully re-linked back into Outlook profile.
9810	PST unlink failure	Error	A non-local PST file fails to unlink from an Outlook profile at logon.
9811	PST unlink success	Information	A non-local PST file is unlinked from an Outlook profile at logon.
9812	ILS configuration failure	Error	An error occurs while processing the ILS configuration.
9813	Delete request failure	Error	An error occurs while handling a delete request.
9814	Delete request success	Information	A file delete or move operation succeeds.
9815	Delete map point success	Information	A map point has been successfully deleted.
9816	Low disk space	Information	Low disk space has been reported for a download
9817	Cache cleanup failure	Error	Cache cleanup feature is enabled but failed to remove a file from the local cache.
9818	Cache cleanup success	Information	Cache cleanup feature has removed a file from the local cache.
9819	Logoff cache cleanup success	Information	Cache cleanup feature has removed a set of files from the local cache at logoff.
9820	Logoff cache sync timeout	Error	The specified timeout period for cached files to synchronize before logoff has been exceeded.
9821	Cache fully in-sync at logoff	Information	Cached files were fully synchronized at logoff.
9822	Logoff delay in milliseconds	Information	The timeout period specified (in milliseconds) to enable cached files to synchronize before logoff.
9823	Process blocklist too long	Error	The process blocklist has not been applied as it exceeds the maximum length of 4096 characters.
9824	Logon cache statistics	Information	Audit of the cache size and number of files at logon. The message is issued at the end of logon synchronization. Note, many minutes may elapse before synchronization completes and this message is issued.
9825	File not in-sync	Information	A cache file which is preventing the sync status from going to in-sync during a cache scan.
9826	Cache database integrity check failure	Information	The cache database for a user has been discarded and rebuilt due to an integrity check failure.
9827	Client has gone offline	Information	The client has gone offline due to network connectivity issues Note, this audit message is intended for internal use only and is disabled by default.
9828	Client has gone online	Information	The client has gone back online Note, this audit message is intended for internal use only and is disabled by default.
9829	Client logon sync has completed	Information	The logon sync has completed for a user.
9830	Cache database schema upgrade	Information	The cache database for a user has been discarded and rebuilt due to a change in schema for the cache database.
9831	Alternate Data Streams for cache data removed	Information	The Alternate Data Streams for all cache files and folders have been removed due to the data being moved to alternate storage.
9832	Owner rule has failed to lookup the account name	Error	An owner rule has evaluated incorrectly due to failed lookup of account name. For example, where issues exist with the domain user account or the domain lookup.
9833	Parsing the configured scan rules has failed	Error	An error occurred while parsing the configured scan rules. For example, if the syntax for the expression used for the scan rules is incorrect.
9834	Summary of Outside the Profile data scan	Information	Summary results for the Outside the Profile data scan includes number of files, total size and scan duration.

System Events

Event ID	Event Name	Event Description
Event ID	Event Name	Event Description
8000	Service Started	[ProductName] Agent: Service Started.
8001	Service Stopped	[ProductName] Agent: Service stopped.
8095	No Configuration found	[ProductName] cannot find a valid configuration.
8096	Configuration Upgraded	A configuration for a previous version of [ProductName] has been detected and upgraded.
9099	Invalid License	[ProductName] software is not licensed.

Anonymous Logging

Always use anonymous MACHINE name in events — Events for actions performed on specific computers are reported without recording the computer name.
Always use anonymous USER name in events — Events for actions by specific users are reported without recording the user name.

Event Filter

Provides expandable lists of events by product which you can select either individually or by product group to generate and send to the Management Server.

The following details the Event Filter columns.

Column	Description
Product event ID	Indicates the product name and the four digit event ID numbers for the events available for the selected product.
Event description	Description of the event. You may wish to disable certain types of events which are generated in large quantity to avoid inundating the server.
Enabled	Select to enable an event. Select this option in the top level list item to enable all events in the group.

Deployment Group Settings Auditing

Anonymous Logging

Event Filter

Related topics