Back to top

Device audit events

Last updated July 26th, 2023

The following table contains all audit events concerning devices enrolled with Knox Manage.

Event Category Event Name
  • Device Boot Completed
  • Change Network Connectivity
  • Change Agent Context
  • Initialize Agent
  • EMM Login Failed
  • EMM Client Screen UnLock Failed
  • EMM Login Failed Count Exceeded
  • EMM Client Screen UnLock Failed Count Exceeded
  • Change Screen Lock Password EMM Client
  • Application installation request (Kiosk)
  • Application list request (Kiosk)
  • Cert Issue Fail (Key Generation Error)
  • Cert Verification Fail (Unknown)
  • BasicConstraints Check Error
  • Path Check Error
  • Valid Date Check Error
  • CRL(Certificate Revocation List) Check Error
  • Cert Verification Fail (Unknown)
  • Cert Issue Request
  • Cert Issue Success
  • Cert Issue Fail (Parameter Error)
  • Cert Issue Fail (Not-initialized Object Error)
  • Cert Issue Fail (Internal Error)
  • Failed to establish connection to certificate revocation status
  • Check System Forgery
  • Violated version control policy (Device)
  • Violated recording prevention policy (Device)
  • Managed Google Play token issuance (Device)
  • Managed Google Play account registration (Device)
  • Managed Google Play account report (Device)
  • Managed Google Play account removal (Device)
  • SIM card has changed.
  • Network usage has been reset.
  • Cellular data limit has been reached.
  • Call limit has been reached.
  • Agent has been started.
  • Agent has been closed.
  • Randomization process failed
  • Policy validation failed
  • Result of importing the certificates to be used for authenticating agent communications
  • Managed Google Play account revoked (Device)
  • Failed to lock EMM screen (Device)
  • Log on status is changed to logout. (Device)
  • Request to device unenrollment by user
  • Request to device unenrollment by user policy is changed
Device Command
  • Keepalive Time Limited
  • Keepalive Notice
  • Device Command Received
  • Verify Device Command
  • Device Command Added
  • Device Command Process Started
  • Device Command Process Finished
  • Failure Installation Package
  • Failure Installation Package in Knox
  • Failure Uninstallation Package
  • Failure Uninstallation Package in Knox
  • Device Diagnosis Information
  • Device Lock/Unlock History
  • Failure Installation Package in Work Profile
  • Failure Uninstallation Package in Work Profile
  • Policy violation detected
  • Exit due to policy violation
  • Change Trigger State
  • Change Profile
  • Push Registration Succeeded
  • Push Unregistration Succeeded
  • Enroll EMM Agent Started
  • Enroll EMM Agent
  • Unenroll EMM Agent Started
  • Unenroll EMM Agent
  • Enable Device Admin
  • Disable Device Admin
  • Enrollment Request by UMC Agent
  • Report for UMC Agent activation
  • Report Unenrollment Completion to UMC Agent
  • Activate ELM License
  • Activate KLMS License
  • Send EMM Agent Log
  • Change Audit Event Allowlist
  • Start Audit Logging
  • Receive Audit Event Allowlist
  • Send Audit Log To Server
  • Device Password Attempts Failed Count Exceeded
  • Scheduler Raised
  • SIM card PIN code change
  • Result for applying Kiosk mode
  • Factory Reset Protection policy configured successfully
  • Agreed to disable fingerprint lock (Device)

Is this page helpful?