System Events
Under System Events you will find the results and a summary of the log data of your servers and clients recorded by the Pulsar agent.
Use the search bar to search and filter the view. For example, to display all login attempts, select the Logon category. You can further modify your selection by restricting the status to failure or success.
You can also specify the time period of the system events displayed at the top and export either the results or entire views directly from the platform.
Activate recording of the system events
To monitor system events with Enginsight, the recording of security-relevant events must be activated for the corresponding hosts.
To do this, either go to the settings of the individual host or use the policies.
Please note that the Pulsar agent can only monitor those system events that are also logged by the operating system. For example, if login auditing is deactivated on Windows or the Linux auditing system is not installed on Linux, Enginsight can no longer access the events.
Log and monitor object accesses (Windows)
Enginsight can be used to log access to sensitive files and folders on Windows and to set alarms for unusual access. To do this, logging must first be enabled on Windows via a group policy and it must be defined on the server which folders are to be monitored. Only then can the results be viewed in Enginsight and alarms be activated.
Enable object access monitoring in group policies
You can enable object access monitoring either as a local or domain-wide group policy.
Enable object access monitoring only on servers where you want to use the feature. In certain cases, Windows generates events for folders that you have not designated for monitoring. This can result in false positives.
Open the Group Policy Management Editor.
Navigate to Computer Configuration → Policies → Windows Settings → Local Policies → Audit Policy.
Open "Audit object access".
Set a check mark at "Audit these attempts" for both Successful and Failure.
Click OK.
Run gpupdate /force from the command line to activate the group policy.
Define folders and/or files to monitor
1. Go to the file server where you want to monitor accesses.
2. Open the properties of the corresponding folder or file.
3. Navigate to the Security tab and click the Advanced button.
4. Navigate to the Auditing tab and click the Add button.
5. Enter "All" as the principal/object name.
6. Check all the boxes under Extended permissions.
7. Click OK.
8. Enable the option: "Replace alle child object auditing entries with inheritable auditing entries from this object".
9. Click OK to complete the configuration.
Enable recording of security-relevant events (system events).
Make sure that you have enabled the recording of security-relevant events for the desired hosts so that you can get the results of the access monitoring.
Viewing access in system events
To view system events across all hosts, navigate to Hosts → System Events.
If you want to examine only one host, select the corresponding host from the overview and navigate from the host's overview to the host-specific system events.
To filter the system event results by access to the defined folders/files, select the Audit Object Access category. For further specification, you can select the following subcategories:
Audit Object Read Access: reading access
Audit Object Modify Access: Editing access (content and/or attributes)
Audit Object Create Access: creating access
Audit Object Delete Access: Deleting access
You will receive the following information for each access:
User (down-level logon name) who accessed.
Process through which the access was made.
File/directory that was accessed.
Configure alerts
To be informed about unusual or unauthorized access, you can set two alarms.
Object access outside business hours: Set a time period when accesses are usual. If an access takes place outside this period, the alarm will be triggered.
Unauthorized object access: set users who are allowed access. Specify users in down-level Logon Name notation (i.e. DOMAIN\UserName, e.g. AzureAD\MaxMustermann). If another user accesses the object, the alert is triggered.
Turn on the alarm only on servers you actually want to monitor (via reference or appropriate tag). Windows in certain cases generates events for folders that you have not designated for monitoring. This may result in false alarms.
Overview of all recording events
Linux
sshd
An account was successfully logged on. (Success)
A logon was attempted using explicit credentials. (Failure)
pam_unix
A logon was attempted using explicit credentials. (Failure)
MySQL
A logon was attempted using explicit credentials. (Failure)
Linux Auditing System: auditd
To get the system events via the Linux Auditing System, it may be necessary to manually install auditd
.
sudo apt-get install auditd auditd start
However, some distributions already have auditd
installed by default.
ACCT_LOCK
: User-space user account is locked by the administrator.ACCT_UNLOCK
: User-space user account is unlocked by the administrator.ADD_GROUP
: User-space group is added.ADD_USER
: User-space user account is added.ANOM_ABEND
: Processes ends abnormally (with a signal that could cause a core dump, if enabled).ANOM_ACCESS_FS
: File or a directory access ends abnormally.ANOM_ADD_ACCT
: User-space account addition ends abnormally.ANOM_AMTU_FAIL
: Failure of the Abstract Machine Test Utility (AMTU) is detected.ANOM_CRYPTO_FAIL
: Failure in the cryptographic system is detected.ANOM_DEL_ACCT
: User-space account deletion ends abnormally.ANOM_EXEC
: Execution of a file ends abnormally.ANOM_LINK
: Suspicious use of file links is detected.ANOM_LOGIN_ACCT
: Account login attempt ends abnormally.ANOM_LOGIN_FAILURES
: Limit of failed login attempts is reached.ANOM_LOGIN_LOCATION
: Login attempt is made from a forbidden location.ANOM_LOGIN_SESSIONS
: Login attempt reaches the maximum amount of concurrent sessions.ANOM_LOGIN_TIME
: Login attempt is made at a time when it is prevented by, for example, pam_time.ANOM_MAX_DAC
: Maximum amount of Discretionary Access Control (DAC) failures is reached.ANOM_MAX_MAC
: Maximum amount of Mandatory Access Control (MAC) failures is reached.ANOM_MK_EXEC
: File is made executable.ANOM_MOD_ACCT
: User-space account modification ends abnormally.ANOM_PROMISCUOUS
: Device enables or disables promiscuous mode.ANOM_RBAC_FAIL
: Role-Based Access Control (RBAC) self-test failure is detected.ANOM_RBAC_INTEGRITY_FAIL
: Role-Based Access Control (RBAC) file integrity test failure is detected.ANOM_ROOT_TRANS
: User becomes root.AVC
: Record an SELinux permission check.AVC_PATH
: Record the dentry and vfsmount pair when an SELinux permission check occurs.BPRM_FCAPS
: User executes a program with a file system capability.CAPSET
: Record the capabilities being set for process-based capabilities, for example, running as root to drop capabilities.CHGRP_ID
: User-space group ID is changed.CHUSER_ID
: User-space user ID is changed.CONFIG_CHANGE
: Audit system configuration is modified.CRED_ACQ
: User acquires user-space credentials.CRED_DISP
: User disposes of user-space credentials.CRED_REFR
: User refreshes their user-space credentials.CRYPTO_FAILURE_USER
: Decrypt, encrypt, or randomize cryptographic operation fails.CRYPTO_IKE_SA
: Internet Key Exchange Security Association is established.CRYPTO_IPSEC_SA
: Internet Protocol Security Association is established.CRYPTO_KEY_USER
: Record the cryptographic key identifier used for cryptographic purposes.CRYPTO_LOGIN
: Cryptographic officer login attempt is detected.CRYPTO_LOGOUT
: Cryptographic officer logout attempt is detected.CRYPTO_PARAM_CHANGE_USER
: Change in a cryptographic parameter is detected.CRYPTO_REPLAY_USER
: Replay attack is detected.CRYPTO_SESSION
: Record parameters set during a TLS session establishment.CRYPTO_TEST_USER
: Record cryptographic test results as required by the FIPS-140 standard.CWD
: Record the current working directory.DAC_CHECK
: Record DAC check results.DAEMON_ABORT
: Daemon is stopped due to an error.DAEMON_ACCEPT
: Auditd daemon accepts a remote connection.DAEMON_CLOSE
: Auditd daemon closes a remote connection.DAEMON_CONFIG
: Daemon configuration change is detected.DAEMON_END
: Daemon is successfully stopped.DAEMON_ERR
: Auditd daemon internal error is detected.DAEMON_RESUME
: Auditd daemon resumes logging.DAEMON_ROTATE
: Auditd daemon rotates the Audit log files.DAEMON_START
: Auditd daemon is started.DEL_GROUP
: User-space group is deletedDEL_USER
: User-space user is deletedDEV_ALLOC
: Device is allocated.DEV_DEALLOC
: Device is deallocated.EOE
: Record the end of a multi-record event.EXECVE
: Record arguments of the execve(2) system call.FANOTIFY
: Fanotify access decision is made.FD_PAIR
: Record the use of the pipe and socketpair system calls.FEATURE_CHANGE
: Audit feature changed value.FS_RELABEL
: File system relabel operation is detected.GRP_AUTH
: Group password is used to authenticate against a user-space group.GRP_CHAUTHTOK
: Group account password or PIN is modified.GRP_MGMT
: Record user-space group account attribute modification.INTEGRITY_DATA
: Record a data integrity verification event run by the kernel.INTEGRITY_EVM_XATTR
: EVM-covered extended attribute is modified.INTEGRITY_HASH
: Record a hash type integrity verification event run by the kernel.INTEGRITY_METADATA
: Record a metadata integrity verification event run by the kernel.INTEGRITY_PCR
: Record Platform Configuration Register (PCR) invalidation messages.INTEGRITY_RULE
: Record a policy rule.INTEGRITY_STATUS
: Record the status of integrity verification.IPC
: Record information about a Inter-Process Communication object referenced by a system call.IPC_SET_PERM
: Record information about new values set by an IPC_SET control operation on an IPC object.KERN_MODULE
: Record a kernel module name on load or unload.KERNEL
: Record the initialization of the Audit system.KERNEL_OTHER
: Record information from third-party kernel modules.LABEL_LEVEL_CHANGE
: Object's level label is modified.LABEL_OVERRIDE
: Administrator overrides an object's level label.LOGIN
: Record relevant login information when a user log in to access the system.MAC_CALIPSO_ADD
: NetLabel CALIPSO DOI entry is added.MAC_CALIPSO_DEL
: NetLabel CALIPSO DOI entry is deleted.MAC_CHECK
: User space MAC (Mandatory Access Control) decision is made.MAC_CIPSOV4_ADD
: Commercial Internet Protocol Security Option (CIPSO) user adds a new Domain of Interpretation (DOI). Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.MAC_CIPSOV4_DEL
: CIPSO user deletes an existing DOI. Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.MAC_CONFIG_CHANGE
: SELinux Boolean value is changed.MAC_IPSEC_EVENT
: Record information about an IPSec event, when one is detected, or when the IPSec configuration changes.MAC_MAP_ADD
: New Linux Security Module (LSM) domain mapping is added. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.MAC_MAP_DEL
: Existing LSM domain mapping is deleted. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.MAC_POLICY_LOAD
: SELinux policy file is loaded.MAC_STATUS
: SELinux mode (enforcing, permissive, off) is changed.MAC_UNLBL_ALLOW
: Unlabeled traffic is allowed when using the packet labeling capabilities of the kernel provided by NetLabel.MAC_UNLBL_STCADD
: Static label is added when using the packet labeling capabilities of the kernel provided by NetLabel.MAC_UNLBL_STCDEL
: Static label is deleted when using the packet labeling capabilities of the kernel provided by NetLabel.MMAP
: Record a file descriptor and flags of the mmap(2) system call.MQ_GETSETATTR
: Record the mq_getattr(3) and mq_setattr(3) message queue attributes.MQ_NOTIFY
: Record arguments of the mq_notify(3) system call.MQ_OPEN
: Record arguments of the mq_open(3) system call.MQ_SENDRECV
: Record arguments of the mq_send(3) and mq_receive(3) system calls.NETFILTER_CFG
: Netfilter chain modifications are detected.NETFILTER_PKT
: Record packets traversing Netfilter chains.OBJ_PID
: Record information about a process to which a signal is sent.PATH
: Record file name path information.PROCTITLE
: Gives the full command-line that triggered this Audit event, triggered by a system call to the kernel.RESP_ACCT_LOCK
: User account is locked.RESP_ACCT_LOCK_TIMED
: User account is locked for a specified period of time.RESP_ACCT_REMOTE
: User account is locked from a remote session.RESP_ACCT_UNLOCK_TIMED
: User account is unlocked after a configured period of time.RESP_ALERT
: Alert email is sent.RESP_ANOMALY
: Anomaly was not acted upon.RESP_EXEC
: Intrusion detection program responds to a threat originating from the execution of a program.RESP_HALT
: System is shut down.RESP_KILL_PROC
: Process is terminated.RESP_SEBOOL
: SELinux Boolean value is set.RESP_SINGLE
: System is put into single-user mode.RESP_TERM_ACCESS
: Session is terminated.RESP_TERM_LOCK
: Terminal is locked.ROLE_ASSIGN
: Administrator assigns a user to an SELinux role.ROLE_MODIFY
: Administrator modifies an SELinux role.ROLE_REMOVE
: Administrator removes a user from an SELinux role.SECCOMP
: SECure COMPuting event is detected.SELINUX_ERR
: Internal SELinux error is detected.SERVICE_START
: Service is started.SERVICE_STOP
: Service is stopped.SOCKADDR
: Record a socket address.SOCKETCALL
: Record arguments of the sys_socketcall system call (used to multiplex many socket-related system calls).SOFTWARE_UPDATE
: Record software update events.SYSCALL
: Record a system call to the kernel.SYSTEM_BOOT
: System is booted up.SYSTEM_RUNLEVEL
: System's run level is changed.SYSTEM_SHUTDOWN
: System is shut down.TEST
: Record the success value of a test message.TIME_ADJNTPVAL
: System clock is modified.TIME_INJOFFSET
: Timekeeping offset is injected to the sytem clock.TRUSTED_APP
: The record of this type can be used by third party application that require auditing.TTY
: TTY input was sent to an administrative process.USER_ACCT
: User-space user authorization attempt is detected.USER_AUTH
: User-space user authentication attempt is detected.USER_AVC
: User-space AVC message is generated.USER_CHAUTHTOK
: User account password or PIN is modified.USER_CMD
: User-space shell command is executed.USER_DEVICE
: User-space hotplug device is changed.USER_END
: User-space session is terminated.USER_ERR
: User account state error is detected.USER_LABELED_EXPORT
: Object is exported with an SELinux label.USER_LOGIN
: User logs in.USER_LOGOUT
: User logs out.USER_MAC_POLICY_LOAD
: User-space daemon loads an SELinux policy.USER_MGMT
: Record user-space user account attribute modification.USER_ROLE_CHANGE
: User's SELinux role is changed.USER_SELINUX_ERR
: User-space SELinux error is detected.USER_START
: User-space session is started.USER_TTY
: Explanatory message about TTY input to an administrative process is sent from user-space.USER_UNLABELED_EXPORT
: Object is exported without SELinux label.USYS_CONFIG
: User-space system configuration change is detected.VIRT_CONTROL
: Virtual machine is started, paused, or stopped.VIRT_MACHINE_ID
: Record the binding of a label to a virtual machine.VIRT_RESOURCE
: Record resource assignment of a virtual machine.
Windows
1101: Audit events have been dropped by the transport. (Success)
4609: Windows is shutting down (Success)
4646: IKE DoS-prevention mode started (Success)
4650: An IPsec Main Mode security association was established (Success)
4651: An IPsec Main Mode security association was established (Success)
4652: An IPsec Main Mode negotiation failed (Failure)
4653: An IPsec Main Mode negotiation failed (Failure)
4654: An IPsec Quick Mode negotiation failed (Failure)
4655: An IPsec Main Mode security association ended (Success)
4659: A handle to an object was requested with intent to delete (Success)
4665: An attempt was made to create an application client context. (Success)
4666: An application attempted an operation (Success)
4667: An application client context was deleted (Success)
4668: An application was initialized (Success)
4709: IPsec Services was started (Success)
4710: IPsec Services was disabled (Success)
4711: PAStore Engine (1%) (Success)
4712: IPsec Services encountered a potentially serious failure (Failure)
4727: A security-enabled global group was created (Success)
4728: A member was added to a security-enabled global group (Success)
4729: A member was removed from a security-enabled global group (Success)
4730: A security-enabled global group was deleted (Success)
4737: A security-enabled global group was changed (Success)
4744: A security-disabled local group was created (Success)
4745: A security-disabled local group was changed (Success)
4746: A member was added to a security-disabled local group (Success)
4747: A member was removed from a security-disabled local group (Success)
4748: A security-disabled local group was deleted (Success)
4754: A security-enabled universal group was created (Success)
4755: A security-enabled universal group was changed (Success)
4756: A member was added to a security-enabled universal group (Success)
4757: A member was removed from a security-enabled universal group (Success)
4758: A security-enabled universal group was deleted (Success)
4759: A security-disabled universal group was created (Success)
4760: A security-disabled universal group was changed (Success)
4761: A member was added to a security-disabled universal group (Success)
4762: A member was removed from a security-disabled universal group (Success)
4763: A security-disabled universal group was deleted (Success)
4783: A basic application group was created (Success)
4784: A basic application group was changed (Success)
4785: A member was added to a basic application group (Success)
4786: A member was removed from a basic application group (Success)
4787: A non-member was added to a basic application group (Success)
4788: A non-member was removed from a basic application group.. (Success)
4789: A basic application group was deleted (Success)
4790: An LDAP query group was created (Success)
4791: A basic application group was changed (Success)
4792: An LDAP query group was deleted (Success)
4797: An attempt was made to query the existence of a blank password for an account (Success)
4820: A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions (Failure)
4821: A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions (Failure)
4822: NTLM authentication failed because the account was a member of the Protected User group (Failure)
4823: NTLM authentication failed because access control restrictions are required (Failure)
4824: Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group (Failure)
4825: A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group (Success)
4830: SID History was removed from an account (Success)
4868: The certificate manager denied a pending certificate request (Success)
4869: Certificate Services received a resubmitted certificate request (Success)
4870: Certificate Services revoked a certificate (Success)
4871: Certificate Services received a request to publish the certificate revocation list (CRL) (Success)
4872: Certificate Services published the certificate revocation list (CRL) (Success)
4873: A certificate request extension changed (Success)
4874: One or more certificate request attributes changed. (Success)
4875: Certificate Services received a request to shut down (Success)
4876: Certificate Services backup started (Success)
4877: Certificate Services backup completed (Success)
4878: Certificate Services restore started (Success)
4879: Certificate Services restore completed (Success)
4880: Certificate Services started (Success)
4881: Certificate Services stopped (Success)
4882: The security permissions for Certificate Services changed (Success)
4883: Certificate Services retrieved an archived key (Success)
4884: Certificate Services imported a certificate into its database (Success)
4885: The audit filter for Certificate Services changed (Success)
4886: Certificate Services received a certificate request (Success)
4887: Certificate Services approved a certificate request and issued a certificate (Success)
4888: Certificate Services denied a certificate request (Failure)
4889: Certificate Services set the status of a certificate request to pending (Success)
4890: The certificate manager settings for Certificate Services changed. (Success)
4891: A configuration entry changed in Certificate Services (Success)
4892: A property of Certificate Services changed (Success)
4893: Certificate Services archived a key (Success)
4894: Certificate Services imported and archived a key (Success)
4895: Certificate Services published the CA certificate to Active Directory Domain Services (Success)
4896: One or more rows have been deleted from the certificate database (Success)
4897: Role separation enabled (Success)
4898: Certificate Services loaded a template (Success)
4899: A Certificate Services template was updated (Success)
4900: Certificate Services template security was updated (Success)
on this computer (Success)
4960: IPsec dropped an inbound packet that failed an integrity check (Success)
4961: IPsec dropped an inbound packet that failed a replay check (Success)
4962: IPsec dropped an inbound packet that failed a replay check (Success)
4963: IPsec dropped an inbound clear text packet that should have been secured (Success)
4965: IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). (Success)
4976: During Main Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4977: During Quick Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4978: During Extended Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4979: IPsec Main Mode and Extended Mode security associations were established. (Success)
4980: IPsec Main Mode and Extended Mode security associations were established (Success)
4981: IPsec Main Mode and Extended Mode security associations were established (Success)
4982: IPsec Main Mode and Extended Mode security associations were established (Success)
4983: An IPsec Extended Mode negotiation failed (Success)
4984: An IPsec Extended Mode negotiation failed (Success)
5040: A change has been made to IPsec settings. An Authentication Set was added. (Success)
5041: A change has been made to IPsec settings. An Authentication Set was modified (Success)
5042: A change has been made to IPsec settings. An Authentication Set was deleted (Success)
5043: A change has been made to IPsec settings. A Connection Security Rule was added (Success)
5044: A change has been made to IPsec settings. A Connection Security Rule was modified (Success)
5045: A change has been made to IPsec settings. A Connection Security Rule was deleted (Success)
5046: A change has been made to IPsec settings. A Crypto Set was added (Success)
5047: A change has been made to IPsec settings. A Crypto Set was modified (Success)
5048: A change has been made to IPsec settings. A Crypto Set was deleted (Success)
5049: An IPsec Security Association was deleted (Success)
5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE (Failure)
5071: Key access denied by Microsoft key distribution service (Failure)
5120: OCSP Responder Service Started (Success)
5121: OCSP Responder Service Stopped (Success)
5122: A Configuration entry changed in the OCSP Responder Service (Success)
5123: A configuration entry changed in the OCSP Responder Service (Success)
5124: A security setting was updated on OCSP Responder Service (Success)
5125: A request was submitted to OCSP Responder Service (Success)
5126: Signing Certificate was automatically updated by the OCSP Responder Service (Success)
5127: The OCSP Revocation Provider successfully updated the revocation information (Success)
5146: The Windows Filtering Platform has blocked a packet (Failure)
5147: A more restrictive Windows Filtering Platform filter has blocked a packet (Failure)
5169: A directory service object was modified (Success)
5170: A directory service object was modified during a background cleanup task (Success)
5380: Vault Find Credential (Success)
5381: Vault credentials were read (Success)
5382: Vault credentials were read (Success)
5440: The following callout was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5441: The following filter was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5442: The following provider was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5443: The following provider context was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5444: The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5446: A Windows Filtering Platform callout has been changed (Success)
5448: A Windows Filtering Platform provider has been changed (Success)
5449: A Windows Filtering Platform provider context has been changed (Success)
5450: A Windows Filtering Platform sub-layer has been changed (Success)
5451: An IPsec Quick Mode security association was established (Success)
5452: An IPsec Quick Mode security association ended (Success)
5453: An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started (Success)
5456: PAStore Engine applied Active Directory storage IPsec policy on the computer (Success)
5457: PAStore Engine failed to apply Active Directory storage IPsec policy on the computer (Success)
5458: PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer (Success)
5459: PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer (Failure)
5460: PAStore Engine applied local registry storage IPsec policy on the computer (Success)
5461: PAStore Engine failed to apply local registry storage IPsec policy on the computer (Failure)
5462: PAStore Engine failed to apply some rules of the active IPsec policy on the computer (Failure)
5463: PAStore Engine polled for changes to the active IPsec policy and detected no changes (Success)
5464: PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services (Success)
5465: PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully (Success)
5466: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead (Failure)
5467: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy (Failure)
5468: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes (Success)
5471: PAStore Engine loaded local storage IPsec policy on the computer (Success)
5472: PAStore Engine failed to load local storage IPsec policy on the computer (Failure)
5473: PAStore Engine loaded directory storage IPsec policy on the computer (Success)
5474: PAStore Engine failed to load directory storage IPsec policy on the computer (Failure)
5477: PAStore Engine failed to add quick mode filter (Failure)
5478: IPsec Services has started successfully (Success)
5479: IPsec Services has been shut down successfully (Success)
5480: IPsec Services failed to get the complete list of network interfaces on the computer (Failure)
5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started (Failure)
5484: IPsec Services has experienced a critical failure and has been shut down (Failure)
5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces (Failure)
6272: Network Policy Server granted access to a user (Success)
6273: Network Policy Server denied access to a user (Success)
6274: Network Policy Server discarded the request for a user (Success)
6275: Network Policy Server discarded the accounting request for a user (Success)
6276: Network Policy Server quarantined a user (Success)
6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy (Success)
6278: Network Policy Server granted full access to a user because the host met the defined health policy (Success)
6279: Network Policy Server locked the user account due to repeated failed authentication attempts (Success)
6280: Network Policy Server unlocked the user account (Success)
(Failure)
6417: The FIPS mode crypto selftests succeeded (Success)
6418: The FIPS mode crypto selftests failed (Success)
8191: Highest System-Defined Audit Message Value (Success)
Last updated
Was this helpful?