Device audit events
Last updated October 31st, 2024
This page lists event categories and audit events available for devices enrolled with Knox Manage. The tables provide the audit events grouped under each event category, such as Agent, Application, Certificate, and so on.
Agent
| Event ID |
Event name |
| DDEV0031 |
Device Boot Completed |
| DDEV0062 |
Change Network Connectivity |
| DDEV0158 |
Change Agent Context |
| DDEV0159 |
Initialize Agent |
| DUSR0001 |
EMM Login Failed |
| DUSR0002 |
EMM Client Screen UnLock Failed |
| DUSR0003 |
EMM Login Failed Count Exceeded |
| DUSR0004 |
EMM Client Screen UnLock Failed Count Exceeded |
| DUSR0005 |
Change Screen Lock Password EMM Client |
Application
| Event ID |
Event name |
| DPLC0060 |
Application installation request (Kiosk) |
| DPLC0061 |
Application list request (Kiosk) |
Certificate
| Event ID |
Event name |
| DAMC0001 |
Certificate Installation Success |
| DAMC0002 |
Certificate Installation Fail |
| DAMC0003 |
Certificate Deletion Success |
| DAMC0004 |
Certificate Deletion Fail |
| DCRT0001 |
Cert Issue Fail(Key Generation Error) |
| DCRT0002 |
Cert Issue Fail(Unknown) |
| DCRT0003 |
BasicConstraints Check Error |
| DCRT0004 |
Path Check Error |
| DCRT0005 |
Valid Date Check Error |
| DCRT0006 |
CRL(Certificate Revocation List) Check Error |
| DCRT0007 |
Cert Verification Fail(Unknown) |
| DCRT0008 |
Cert Issue Request |
| DCRT0009 |
Cert Issue Success |
| DCRT0010 |
Cert Issue Fail(Parameter Error) |
| DCRT0011 |
Cert Issue Fail(Not-initialized Object Error) |
| DCRT0012 |
Cert Issue Fail(Internal Error) |
| DCRT0013 |
Failed to establish connection to certificate revocation status |
Compliance
| Event ID |
Event name |
| DDEV0136 |
Check System Forgery |
| DCCO0001 |
Violated version control policy(Device) |
| DCCO0002 |
Violated recording prevention policy(Device) |
Device
| Event ID |
Event name |
| DDEV0173 |
Managed Google Play token issuance (Device) |
| DDEV0174 |
Managed Google Play account registration (Device) |
| DDEV0175 |
Managed Google Play account report (Device) |
| DDEV0176 |
Managed Google Play account removal (Device) |
| DDEV0177 |
SIM card information. |
| DDEV0178 |
Network usage has been reset. |
| DDEV0179 |
Cellular data limit has been reached. |
| DDEV0180 |
Call limit has been reached. |
| DDEV0181 |
Agent has been started. |
| DDEV0182 |
Agent has been closed. |
| DDEV0183 |
Randomization process failed |
| DDEV0184 |
Policy validation failed |
| DDEV0185 |
Result of importing the certificates to be used for authenticating agent communications |
| DDEV0189 |
Managed Google Play account revoked (Device) |
| DCDE0001 |
Failed to lock EMM screen (Device) |
| DCDE0002 |
Log on status is changed to logout. (Device) |
| DCDE0003 |
Request to device unenrollment by user |
| DCDE0004 |
Request to device unenrollment by user policy is changed |
| DDEV0190 |
License Expired |
| DDEV0191 |
Send When Current Physical SIM Changed |
Device Command
| Event ID |
Event name |
| DDEV0146 |
Keepalive Time Limited |
| DDEV0147 |
Keepalive Notice |
| DDEV0150 |
Device Command Received |
| DDEV0151 |
Verify Device Command |
| DDEV0153 |
Device Command Added |
| DDEV0154 |
Device Command Process Started |
| DDEV0155 |
Device Command Process Finished |
| DDEV0160 |
Failure Installation Package |
| DDEV0161 |
Failure Installation Package in Knox |
| DDEV0162 |
Failure Uninstallation Package |
| DDEV0163 |
Failure Uninstallation Package in Knox |
| DDEV0164 |
Device Diagnosis Information |
| DDEV0165 |
Device Lock/Unlock History |
| DDEV0166 |
Failure Installation Package in Work Profile |
| DDEV0167 |
Failure Uninstallation Package in Work Profile |
| DDEV0168 |
Policy violation detected |
| DDEV0169 |
Exit due to policy violation |
| DPLC0039 |
Change Trigger State |
| DPLC0041 |
Change Profile |
Enrollment
| Event ID |
Event name |
| DAPT0001 |
Push Registration Succeeded |
| DAPT0003 |
Push Unregistration Succeeded |
| DDEV0001 |
Enroll EMM Agent Started |
| DDEV0002 |
Enroll EMM Agent |
| DDEV0004 |
Unenroll EMM Agent Started |
| DDEV0005 |
Unenroll EMM Agent |
| DDEV0142 |
Enable Device Admin |
| DDEV0144 |
Disable Device Admin |
| DDEV0170 |
Enrollment Request by UMC Agent |
| DDEV0187 |
Report for UMC Agent activation |
| DDEV0188 |
Report Unenrollment Completion to UMC Agent |
| DLIC0002 |
Activate ELM License |
| DLIC0003 |
Activate KLMS License |
Location
| Event ID |
Event name |
| DAMC0005 |
Collect Location Fail |
Log
| Event ID |
Event name |
| DDEV0157 |
Send EMM Agent Log |
| CADT0017 |
Change Audit Event Allowlist |
| DADT0001 |
Start Audit Logging |
| CADT0018 |
Receive Audit Event Allowlist |
| DCLT0001 |
Send Audit Log To Server |
Profile
| Event ID |
Event name |
| DDEV0024 |
Device Password Attempts Failed Count Exceeded |
| DDEV0149 |
Scheduler Raised |
| DDEV0171 |
SIM card PIN code change |
| DDEV0172 |
Result for applying Kiosk mode |
| DDEV0186 |
Factory Reset Protection policy has been configured successfully. |
User
| Event ID |
Event name |
| DCUS0006 |
Agreed to disable fingerprint lock (Device) |