Auditing

Use Auditing to define rules for the capture of auditing information, you can setup rules about where event data is stored for logging to a local file and the application event log, and you can setup filters to specify the events you want to capture in the log.

In this section:

About Auditing
Local Events

About Auditing

Local Auditing allows you to specify whether to log events in the Windows Application Event Log or to a custom Event Log. Events can be written to a local file in CSV or XML format.

By default, the log file is located at

%SYSTEMDRIVE%\AppSenseLogs\Auditing\PerformanceManagerEvents_%COMPUTERNAME%.csv (or .xml)

An alternative location can be configured for the log file. In this mode, auditing also includes an event filter to log only specific events.

When managed by the (Undefined variable: Primary.MC), events are forwarded via the Deployment Agent. Under these conditions, event data storage and filtering is configured through the Management Console.

Make events anonymous

Specify whether events are to be anonymous. If, Yes, the computer name and user name is omitted from all events. Anonymous logging also searches the file path for any instances where a directory matches the username and replaces the directory name with the string USERNAME or COMPUTERNAME.

Send events to local file log

Select whether to send events to the local file log. If Yes, the events are sent to the local log file as specified in the Text box. The default is: %SYSTEMDRIVE%\AppSenseLogs\Auditing\PerformanceManagerEvents_%COMPUTERNAME%.csv

Local file log format

Specify whether the event log is to be saved in XML format or CSV format.

Local Events

The Event filter table is a comprehensive list of all events and is used to select the events you want to audit. You can sort the table numerically by ID number, or alphabetically by Event Name or Event Description. Selected events are highlighted in bold. Click Toggle selected to change the states between selected and cleared.

Events are reported to the local Windows Event Log or the local Event Log, according to the Deployment Group Events settings, and also to the Management Server by the Deployment Agent (CCA), unless otherwise indicated.

Event ID	Event Name	Event Description	Event Log Type
9100	User Memory Usage Warning	Amount of memory consumed by a user has exceeded a warning level set in a User Memory Limit.	Information
9101	User memory usage warning lapsed	Amount of memory consumed by a user has fallen back to a safe level as defined in a User Memory Limit.	Information
9102	User memory usage blocked	Amount of memory available to this user as defined in a User Memory rule has been exceeded. No more memory allocation will be allowed.	Warning
9103	User memory usage blocking lapsed	Amount of memory consumed by a user has fallen back to a safe (non-blocked) level as defined in a User Memory Limit.	Information
9104	Thread Throttling Clamping On	Total CPU Usage has exceeded a threshold and will be clamped.	Information
9105	Thread Throttling Clamping Off	Total CPU Usage has fallen under a threshold and clamping will stop.	Information
9106	Application CPU Usage clamping On	An Application has exceeded its configured hard CPU Usage limit and will be limited to that configured limit.	Information
9107	Per Application Memory Usage Exceeded	Memory usage for a particular application has exceeded a threshold.	Information
9108	Per Application Memory Usage Reduced	Memory usage for a particular application has dropped below a threshold.	Information
9109	Per Application Memory Usage Terminated	An application has been terminated because it used too much memory.	Warning
9110	Application CPU Usage Clamping Off	An application has now fallen below its CPU Usage limit and will no longer be clamped.	Information
9115	Working set trimmed	Working set for an application has been trimmed.	Information
9116	CPU Affinity changed	CPU Affinity of an application has changed.	Information
9119	Per Application Hard Memory Limit Reached	Memory usage for an application reached its hard memory limit	Warning
9120	Thread Throttling - Clamped Processes	Total CPU Usage has exceeded a threshold and applications will be clamped.	Information
9121	Application CPU Soft Limit - Started	Because of the overall CPU Usage a CPU soft limit will be applied to an application.	Information
9122	Application CPU Soft Limit - Stopped	An application will be no longer controlled by an CPU soft limit.	Information
9123	Application CPU Reservation Applied	A CPU Usage reservation was applied to an application.	Information
9124	Disk - Process I/O Queued	One or more processes were subject to I/O queuing.	Information
9150	Windows Performance Counter Error	The Windows performance counters on this machine are missing or broken.	Error
9170	Settings not found in package	Some configuration settings were not found in the configuration package.	Error
9171	Settings not valid in package	Some configuration settings in the configuration package were not valid.	Error
9172	Settings loaded from package	The configuration settings were successfully loaded from the configuration package.	Information
9173	Settings applied live to the Agent	The configuration settings were applied live to a running Performance Manager Agent.	Information
9174	Package has been loaded and all settings applied	All settings in the package have been applied to the Agent.	Information
9175	The package is invalid	The configuration package is invalid.	Error
9176	Package not found	The configuration package does not exist.	Warning
9197	Valid License Found	Performance Manager is licensed.	Information
9198	Invalid License Found	Performance Manager has detected a product license which is not compatible with the current used Performance Manager version. Use the (Undefined variable: Primary.LC) to upgrade your Performance Manager license.	Error
9199	Valid License Not Found	Performance Manager is not licensed.	Error
9200	Application Analyzed	Memory Optimizer has analyzed a known application.	Information
9201	Component Analyzed	Memory Optimizer has analyzed a known component.	Information
9202	Component Optimized	Memory Optimizer has optimized a known component.	Information
9203	Component failed to Optimize	Performance Manager has failed to optimize a component	Warning
9204	Application Identified At Runtime	Memory Optimizer has analyzed a running process and added a new application to the optimization database.	Information
9205	Component Identified At Runtime	Memory Optimizer has analyzed a loaded component in a process and added it to the optimization database.	Information
9206	Database Analyzed	Memory Optimizer has analyzed all known applications within the optimization database.	Information
9207	Database Optimized	Memory Optimizer has optimized all known applications within the optimization database.	Information
9208	Application Optimized	Memory Optimizer has optimized a known application.	Information
9209	Database Cleaned	Memory Optimizer has cleaned the optimization database.	Information
9210	Application Cleaned	Memory Optimizer has cleaned a known application.	Information
9211	Component Cleaned	Memory Optimizer has cleaned a known component.	Information
9212	Out Of Memory	Memory Optimizer has run out of memory and cannot rebase any more	Error
9216	Statistics Collection Strategy	Details of the statistics configuration.	Information
9217	Invalid Local Database Folder	The local statistics database folder is invalid.	Error
9218	General Local Statistics Service Error	An error occurred in the Local Statistics Service.	Error
9219	Disk Cleanup Started	Started cleaning up the local statistics database folder.	Information
9220	Disk Cleanup of Single Database	Deleted a single old local database.	Information
9221	Disk Cleanup Complete	Started cleaning up the local statistics database folder.	Information
9222	Consolidation Search Started	Started searching for databases to consolidate.	Information
9223	Single File Consolidation Started	Started to transfer a local statistics database for consolidation.	Information
9224	Single File Consolidation Completed	Completed the transfer of a local statistics database for consolidation.	Information
9225	Consolidation Search Completed	Finished searching for databases to consolidate.	Information
9226	Statistics Scheduled Collection	Statistics collection is now scheduled at a new collection level.	Information
9228	Database Import Failed	An incoming database could not be imported.	Error
9229	Database Connection Failed	Could not connect to the configured Reporting Database.	Error
9230	Disk Cleanup Started	Started searching for old received databases to delete.	Information
9231	Disk Cleanup Completed	Finished searching for old received databases to delete.	Information
9232	Purge of Reporting Database Started	Started purging the Reporting Database.	Information
9233	Purge of Reporting Database Completed	Finished purging the Reporting Database.	Information
9234	Error in Central Statistics Server	An error occurred in the Central Statistics Service.	Information
9235	Deployment Agent updated native configuration	Detected Deployment Agent has updated the endpoint native configuration path.	Information
9236	Memory exceeded minimum threshold new processes eligible for memory limitations	The system memory has exceeded the minimum threshold. New processes will be eligible for memory limitations.	Information
9237	Memory exceeded minimum threshold	The system memory has fallen back below the minimum threshold. New processes will not be monitored for memory limitations.	Information

System Events

The following are non-configurable system events:

Event ID	Event Name	Event Description
8095	No Configuration found	[Product Name] cannot find a valid configuration
8096	Configuration Upgraded	A configuration for a previous version of [Product Name] has been detected and upgraded.
8099	Invalid License	[Product Name] software is not licensed.