Back to top

Device audit events

Last updated March 27th, 2024

This page lists event categories and audit events available for devices enrolled with Knox Manage. The tables provide the audit events grouped under each event category, such as Agent, Application, Certificate, and so on.


Event ID Event name
DDEV0031 Device Boot Completed
DDEV0062 Change Network Connectivity
DDEV0158 Change Agent Context
DDEV0159 Initialize Agent
DUSR0001 EMM Login Failed
DUSR0002 EMM Client Screen UnLock Failed
DUSR0003 EMM Login Failed Count Exceeded
DUSR0004 EMM Client Screen UnLock Failed Count Exceeded
DUSR0005 Change Screen Lock Password EMM Client


Event ID Event name
DPLC0060 Application installation request (Kiosk)
DPLC0061 Application list request (Kiosk)


Event ID Event name
DCRT0001 Cert Issue Fail(Key Generation Error)
DCRT0002 Cert Issue Fail(Unknown)
DCRT0003 BasicConstraints Check Error
DCRT0004 Path Check Error
DCRT0005 Valid Date Check Error
DCRT0006 CRL(Certificate Revocation List) Check Error
DCRT0007 Cert Verification Fail(Unknown)
DCRT0008 Cert Issue Request
DCRT0009 Cert Issue Success
DCRT0010 Cert Issue Fail(Parameter Error)
DCRT0011 Cert Issue Fail(Not-initialized Object Error)
DCRT0012 Cert Issue Fail(Internal Error)
DCRT0013 Failed to establish connection to certificate revocation status


Event ID Event name
DDEV0136 Check System Forgery
DCCO0001 Violated version control policy(Device)
DCCO0002 Violated recording prevention policy(Device)


Event ID Event name
DDEV0173 Managed Google Play token issuance (Device)
DDEV0174 Managed Google Play account registration (Device)
DDEV0175 Managed Google Play account report (Device)
DDEV0176 Managed Google Play account removal (Device)
DDEV0177 SIM card information.
DDEV0178 Network usage has been reset.
DDEV0179 Cellular data limit has been reached.
DDEV0180 Call limit has been reached.
DDEV0181 Agent has been started.
DDEV0182 Agent has been closed.
DDEV0183 Randomization process failed
DDEV0184 Policy validation failed
DDEV0185 Result of importing the certificates to be used for authenticating agent communications
DDEV0189 Managed Google Play account revoked (Device)
DCDE0001 Failed to lock EMM screen (Device)
DCDE0002 Log on status is changed to logout. (Device)
DCDE0003 Request to device unenrollment by user
DCDE0004 Request to device unenrollment by user policy is changed
DDEV0190 License Expired
DDEV0191 Send When Current Physical SIM Changed

Device Command

Event ID Event name
DDEV0146 Keepalive Time Limited
DDEV0147 Keepalive Notice
DDEV0150 Device Command Received
DDEV0151 Verify Device Command
DDEV0153 Device Command Added
DDEV0154 Device Command Process Started
DDEV0155 Device Command Process Finished
DDEV0160 Failure Installation Package
DDEV0161 Failure Installation Package in Knox
DDEV0162 Failure Uninstallation Package
DDEV0163 Failure Uninstallation Package in Knox
DDEV0164 Device Diagnosis Information
DDEV0165 Device Lock/Unlock History
DDEV0166 Failure Installation Package in Work Profile
DDEV0167 Failure Uninstallation Package in Work Profile
DDEV0168 Policy violation detected
DDEV0169 Exit due to policy violation
DPLC0039 Change Trigger State
DPLC0041 Change Profile


Event ID Event name
DAPT0001 Push Registration Succeeded
DAPT0003 Push Unregistration Succeeded
DDEV0001 Enroll EMM Agent Started
DDEV0002 Enroll EMM Agent
DDEV0004 Unenroll EMM Agent Started
DDEV0005 Unenroll EMM Agent
DDEV0142 Enable Device Admin
DDEV0144 Disable Device Admin
DDEV0170 Enrollment Request by UMC Agent
DDEV0187 Report for UMC Agent activation
DDEV0188 Report Unenrollment Completion to UMC Agent
DLIC0002 Activate ELM License
DLIC0003 Activate KLMS License


Event ID Event name
DDEV0157 Send EMM Agent Log
CADT0017 Change Audit Event Allowlist
DADT0001 Start Audit Logging
CADT0018 Receive Audit Event Allowlist
DCLT0001 Send Audit Log To Server


Event ID Event name
DDEV0024 Device Password Attempts Failed Count Exceeded
DDEV0149 Scheduler Raised
DDEV0171 SIM card PIN code change
DDEV0172 Result for applying Kiosk mode
DDEV0186 Factory Reset Protection policy has been configured successfully.


Event ID Event name
DCUS0006 Agreed to disable fingerprint lock (Device)

Is this page helpful?