Device audit events

The list of device audit events for user devices while using Knox Manage is as follows:

Event Category

Event Name

Certificate Status

  • Cert Issue Fail (Key Generation Error)
  • Cert Verification Fail (Unknown)
  • BasicConstraints Check Error
  • Path Check Error
  • Valid Date Check Error
  • CRL Check Error
  • Cert Verification Fail (Unknown)
  • Cert Issue Request
  • Cert Issue Success
  • Cert Issue Fail (Parameter Error)
  • Cert Issue Fail (Not-initialized Object Error)
  • Cert Issue Fail (Internal Error)


  • Violated version control policy (Device)
  • Violated recording prevention policy (Device)
  • Check System Forgery


  • Failed to lock EMM screen (Device)
  • Log on status is changed to logout (Device)
  • Managed Google Play token issuance (Device)
  • Managed Google Play account registration (Device)
  • Managed Google Play account report (Device)
  • Managed Google Play account removal (Device)
  • SIM Card changed
  • Network usages resetted.
  • Cellular data limit reached.
  • Call limit reached.
  • Agent has been started.
  • Agent has been shutdowned.
  • Failure of the randomization process.
  • Failure of policy validation.
  • Result of importing the certificates to be used for authentication of Agent communications.

Device Command

  • Keepalive Time Limited
  • Keepalive Notice
  • Device Command Received
  • Verify Device Command
  • Device Command Added
  • Device Command Process Started
  • Device Command Process Finished
  • Failure Installation Package
  • Failure Installation Package in KNOX
  • Failure Uninstallation Package
  • Failure Uninstallation Package in KNOX
  • Device Diagnosis Information
  • Device Lock/Unlock History
  • Failure Installation Package in Work Profile
  • Failure Uninstallation Package in Work Profile
  • Policy violation detected
  • Exit due to policy violation
  • Change Trigger State
  • Change Profile

EMM Agent

  • Device Boot Completed
  • Change Network Connectivity
  • Change Agent Context
  • Initialize Agent

EMM Client

  • EMM Login Failed
  • EMM Client Screen UnLock Failed
  • EMM Login Failed Count Exceeded
  • EMM Client Screen UnLock Failed Count Exceeded
  • Change Screen Lock Password EMM Client


  • Push Registration Succeeded
  • Push Unregistration Succeeded
  • Enroll EMM Agent Started
  • Enroll EMM Agent
  • Unenroll EMM Agent Started
  • Unenroll EMM Agent
  • Enable Device Admin
  • Disable Device Admin
  • Activate ELM License
  • Activate KLMS License

Kiosk Launcher

  • Application installation request (Kiosk)
  • Application list request (Kiosk)


  • Start Audit Logging
  • Send Audit Log To Server
  • Send EMM Agent Log


  • Device Password Attempts Failed Count Exceeded
  • Scheduler Raised
  • KioskMode Result
  • SIM card PIN code change
  • Factory Reset Protection policy configured successfully.


  • Agreed to disable fingerprint lock (Device)