This page lists event categories and audit events available for devices enrolled with Knox Manage. The tables provide the audit events grouped under each event category, such as Agent, Application, Certificate, and so on.
Agent
Event ID
Event name
DDEV0031
Device Boot Completed
DDEV0062
Change Network Connectivity
DDEV0158
Change Agent Context
DDEV0159
Initialize Agent
DUSR0001
EMM Login Failed
DUSR0002
EMM Client Screen UnLock Failed
DUSR0003
EMM Login Failed Count Exceeded
DUSR0004
EMM Client Screen UnLock Failed Count Exceeded
DUSR0005
Change Screen Lock Password EMM Client
Application
Event ID
Event name
DPLC0060
Application installation request (Kiosk)
DPLC0061
Application list request (Kiosk)
Certificate
Event ID
Event name
DCRT0001
Cert Issue Fail(Key Generation Error)
DCRT0002
Cert Issue Fail(Unknown)
DCRT0003
BasicConstraints Check Error
DCRT0004
Path Check Error
DCRT0005
Valid Date Check Error
DCRT0006
CRL(Certificate Revocation List) Check Error
DCRT0007
Cert Verification Fail(Unknown)
DCRT0008
Cert Issue Request
DCRT0009
Cert Issue Success
DCRT0010
Cert Issue Fail(Parameter Error)
DCRT0011
Cert Issue Fail(Not-initialized Object Error)
DCRT0012
Cert Issue Fail(Internal Error)
DCRT0013
Failed to establish connection to certificate revocation status
Compliance
Event ID
Event name
DDEV0136
Check System Forgery
DCCO0001
Violated version control policy(Device)
DCCO0002
Violated recording prevention policy(Device)
Device
Event ID
Event name
DDEV0173
Managed Google Play token issuance (Device)
DDEV0174
Managed Google Play account registration (Device)
DDEV0175
Managed Google Play account report (Device)
DDEV0176
Managed Google Play account removal (Device)
DDEV0177
SIM card information.
DDEV0178
Network usage has been reset.
DDEV0179
Cellular data limit has been reached.
DDEV0180
Call limit has been reached.
DDEV0181
Agent has been started.
DDEV0182
Agent has been closed.
DDEV0183
Randomization process failed
DDEV0184
Policy validation failed
DDEV0185
Result of importing the certificates to be used for authenticating agent communications
DDEV0189
Managed Google Play account revoked (Device)
DCDE0001
Failed to lock EMM screen (Device)
DCDE0002
Log on status is changed to logout. (Device)
DCDE0003
Request to device unenrollment by user
DCDE0004
Request to device unenrollment by user policy is changed
DDEV0190
License Expired
DDEV0191
Send When Current Physical SIM Changed
Device Command
Event ID
Event name
DDEV0146
Keepalive Time Limited
DDEV0147
Keepalive Notice
DDEV0150
Device Command Received
DDEV0151
Verify Device Command
DDEV0153
Device Command Added
DDEV0154
Device Command Process Started
DDEV0155
Device Command Process Finished
DDEV0160
Failure Installation Package
DDEV0161
Failure Installation Package in Knox
DDEV0162
Failure Uninstallation Package
DDEV0163
Failure Uninstallation Package in Knox
DDEV0164
Device Diagnosis Information
DDEV0165
Device Lock/Unlock History
DDEV0166
Failure Installation Package in Work Profile
DDEV0167
Failure Uninstallation Package in Work Profile
DDEV0168
Policy violation detected
DDEV0169
Exit due to policy violation
DPLC0039
Change Trigger State
DPLC0041
Change Profile
Enrollment
Event ID
Event name
DAPT0001
Push Registration Succeeded
DAPT0003
Push Unregistration Succeeded
DDEV0001
Enroll EMM Agent Started
DDEV0002
Enroll EMM Agent
DDEV0004
Unenroll EMM Agent Started
DDEV0005
Unenroll EMM Agent
DDEV0142
Enable Device Admin
DDEV0144
Disable Device Admin
DDEV0170
Enrollment Request by UMC Agent
DDEV0187
Report for UMC Agent activation
DDEV0188
Report Unenrollment Completion to UMC Agent
DLIC0002
Activate ELM License
DLIC0003
Activate KLMS License
Log
Event ID
Event name
DDEV0157
Send EMM Agent Log
CADT0017
Change Audit Event Allowlist
DADT0001
Start Audit Logging
CADT0018
Receive Audit Event Allowlist
DCLT0001
Send Audit Log To Server
Profile
Event ID
Event name
DDEV0024
Device Password Attempts Failed Count Exceeded
DDEV0149
Scheduler Raised
DDEV0171
SIM card PIN code change
DDEV0172
Result for applying Kiosk mode
DDEV0186
Factory Reset Protection policy has been configured successfully.