Contents
Events of Kaspersky Security Center Cloud Console components
Each Kaspersky Security Center Cloud Console component has its own set of event types. This section lists types of events that occur in Kaspersky Security Center Cloud Console Administration Server and Network Agent. Types of events that occur in Kaspersky applications are not listed in this section.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Data structure of event type description
For each event type, its display name, identifier (ID), alphabetic code, description, and the default storage term are provided.
- Event type display name. This text is displayed in Kaspersky Security Center Cloud Console when you configure events and when they occur.
- Event type ID. This numerical code is used when you process events by using third-party tools for event analysis.
- Event type (alphabetic code). This code is used when you browse and process events by using public views that are provided in the Kaspersky Security Center Cloud Console database.
- Description. This text contains the situations when an event occurs and what you can do in such a case.
- Default storage term. This is the number of days during which the event is stored in the Administration Server database and is displayed in the list of events on Administration Server. After this period elapses, the event is deleted. If the event storage term value is 0, such events are detected but are not displayed in the list of events on Administration Server.
Administration Server events
This section contains information about the events related to the Administration Server.
Administration Server critical events
The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Critical importance level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Administration Server critical events
Event type display name |
Event type ID |
Event type |
Description |
Default storage term |
|---|---|---|---|---|
License limit has been exceeded |
4099 |
KLSRV_EV_LICENSE_CHECK_MORE_110 |
Once a day Kaspersky Security Center Cloud Console checks whether a license limit is exceeded. Events of this type occur when Administration Server detects that some licensing limits are exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license exceeds 110% of the total number of units covered by the license. Even when this event occurs, client devices are protected. You can respond to the event in the following ways:
Kaspersky Security Center Cloud Console determines the rules to generate events when a license limit is exceeded. |
180 days |
Virus outbreak |
26 (for File Threat Protection) |
GNRL_EV_VIRUS_OUTBREAK |
Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period. You can respond to the event in the following ways:
|
180 days |
Virus outbreak |
27 (for Mail Threat Protection) |
GNRL_EV_VIRUS_OUTBREAK |
Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period. You can respond to the event in the following ways:
|
180 days |
Virus outbreak |
28 (for firewall) |
GNRL_EV_VIRUS_OUTBREAK |
Events of this type occur when the number of malicious objects detected on several managed devices exceeds the threshold within a short period. You can respond to the event in the following ways:
|
180 days |
Device has become unmanaged |
4111 |
KLSRV_HOST_OUT_CONTROL |
Events of this type occur if a managed device is visible on the network but has not connected to Administration Server for a specific period. Find out what prevents the proper functioning of Network Agent on the device. Possible causes include network issues and removal of Network Agent from the device. |
180 days |
Device status is Critical |
4113 |
KLSRV_HOST_STATUS_CRITICAL |
Events of this type occur when a managed device is assigned the Critical status. You can configure the conditions under which the device status is changed to Critical. |
180 days |
Limited functionality mode |
4130 |
KLSRV_EV_LICENSE_SRV_LIMITED_MODE |
Events of this type occur when Kaspersky Security Center Cloud Console starts to operate with basic functionality, without Vulnerability and patch management and without Mobile Device Management features. Following are causes of, and appropriate responses to, the event:
|
180 days |
License expires soon |
4129 |
KLSRV_EV_LICENSE_SRV_EXPIRE_SOON |
Events of this type occur when the commercial license expiration date is approaching. Once a day Kaspersky Security Center checks whether a license expiration date is approaching. Events of this type are published 30 days, 15 days, 5 days and 1 day before the license expiration date. This number of days cannot be changed. If the Administration Server is turned off on the specified day before the license expiration date, the event will not be published until the next day. When the commercial license expires, Kaspersky Security Center Cloud Console provides only basic functionality. You can respond to the event in the following ways:
|
180 days |
MDM certificate has expired |
4132 |
KLSRV_CERTIFICATE_EXPIRED |
Events of this type occur when the Administration Server certificate for Mobile Device Management expires. You need to update the expired certificate. |
180 days |
Updates for Kaspersky application modules have been revoked |
4142 |
KLSRV_SEAMLESS_UPDATE_REVOKED |
Events of this type occur if seamless updates have been revoked (Revoked status is displayed for these updates) by Kaspersky technical specialists; for example, they must be updated to a newer version. The event concerns Kaspersky Security Center Cloud Console patches and does not concern modules of Kaspersky managed applications. The event provides the reason that the seamless updates are not installed. |
180 days |
Audit: Export to SIEM failed |
5130 |
KLAUD_EV_SIEM_EXPORT_ERROR |
Events of this type occur when exporting events to the SIEM system failed due to a connection error with the SIEM system. |
180 days |
Administration Server functional failure events
The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Functional failure importance level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Administration Server functional failure events
Event type display name |
Event type ID |
Event type |
Description |
Default storage term |
|---|---|---|---|---|
Limit of installations has been exceeded for one of the licensed applications groups |
4126 |
KLSRV_INVLICPROD_EXCEDED |
Administration Server generates events of this type periodically (every hour). Events of this type occur if in Kaspersky Security Center Cloud Console you manage license keys of third-party applications and if the number of installations has exceeded the limit set by the license key of the third-party application. You can respond to the event in the following ways:
You can manage license keys of third-party applications using the functionality of licensed applications groups. A licensed applications group includes third-party applications that meet criteria set by you. |
180 days |
Failed to poll the cloud segment |
4143 |
KLSRV_KLCLOUD_SCAN_ERROR |
Events of this type occur when Administration Server fails to poll a network segment in a cloud environment. Read the details in the event description and respond accordingly. |
Not stored |
Administration Server warning events
The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Warning importance level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Administration Server warning events
Event type display name |
Event type ID |
Event type |
Description |
Default storage term |
|---|---|---|---|---|
License limit has been exceeded |
4098 |
KLSRV_EV_LICENSE_CHECK_100_110 |
Once a day Kaspersky Security Center Cloud Console checks whether a license limit is exceeded. Events of this type occur when Administration Server detects that some licensing limits are exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license constitute 100% to 110% of the total number of units covered by the license. Even when this event occurs, client devices are protected. You can respond to the event in the following ways:
Kaspersky Security Center Cloud Console determines the rules to generate events when a license limit is exceeded. |
90 days |
Device has remained inactive on the network for a long time |
4103 |
KLSRV_EVENT_HOSTS_NOT_VISIBLE |
Events of this type occur when a managed device shows inactivity for some time. Most often, this happens when a managed device is decommissioned. You can respond to the event in the following ways:
|
90 days |
Conflict of device names |
4102 |
KLSRV_EVENT_HOSTS_CONFLICT |
Events of this type occur when Administration Server considers two or more managed devices as a single device. Although cloning is not supported in Kaspersky Security Center Cloud Console, this event may occur if you perform cloning using a third-party tool. To avoid the event, when copying the image of a device with Network Agent installed, you have to meet the following recommendations:
The klmover utility is included in the installation package of Network Agent. If you capture the image of a device without Network Agent installed, perform image deployment on target devices and then deploy Network Agent. You have to provide access to the network folder with stand-alone installation packages from a device. |
90 days |
Device status is Warning |
4114 |
KLSRV_HOST_STATUS_WARNING |
Events of this type occur when a managed device is assigned the Warning status. You can configure the conditions under which the device status is changed to Warning. |
90 days |
Limit of installations will soon be reached for one of the licensed applications groups |
4127 |
KLSRV_INVLICPROD_FILLED |
Events of this type occur when the number of installations for third-party applications included in a licensed applications group reaches 90% of the maximum allowed value specified in the license key properties. You can respond to the event in the following ways:
You can manage license keys of third-party applications using the functionality of licensed applications groups. |
90 days |
Certificate has been requested |
4133 |
KLSRV_CERTIFICATE_REQUESTED |
Events of this type occur when a certificate for Mobile Device Management fails to be automatically reissued. Following might be the causes and appropriate responses to the event:
|
90 days |
Certificate has been removed |
4134 |
KLSRV_CERTIFICATE_REMOVED |
Events of this type occur when an administrator removes any type of certificate (General, Mail, VPN) for Mobile Device Management. After removing a certificate, mobile devices connected via this certificate will fail to connect to Administration Server. This event might be helpful when investigating malfunctions associated with the management of mobile devices. |
90 days |
APNs certificate has expired |
4135 |
KLSRV_APN_CERTIFICATE_EXPIRED |
Events of this type occur when an APNs certificate expires. You need to manually renew the APNs certificate and install it on an iOS MDM Server. |
90 days |
APNs certificate expires soon |
4136 |
KLSRV_APN_CERTIFICATE_EXPIRES_SOON |
Events of this type occur when there are fewer than 14 days left before the APNs certificate expires. When the APNs certificate expires, you need to manually renew the APNs certificate and install it on an iOS MDM Server. We recommend that you schedule the APNs certificate renewal in advance of the expiration date. |
90 days |
Failed to send the FCM message to the mobile device |
4138 |
KLSRV_GCM_DEVICE_ERROR |
Events of this type occur when Mobile Device Management is configured to use Google Firebase Cloud Messaging (FCM) for connecting to managed mobile devices with an Android operating system and FCM Server fails to handle some of the requests received from Administration Server. It means that some of the managed mobile devices will not receive a push notification. Read the HTTP code in the details of the event description and respond accordingly. For more information on the HTTP codes received from FCM Server and related errors, please refer to the Google Firebase service documentation (see chapter "Downstream message error response codes"). |
90 days |
HTTP error sending the FCM message to the FCM server |
4139 |
KLSRV_GCM_HTTP_ERROR |
Events of this type occur when Mobile Device Management is configured to use Google Firebase Cloud Messaging (FCM) for connecting managed mobile devices with the Android operating system and FCM Server reverts to the Administration Server a request with a HTTP code other than 200 (OK). Following might be the causes and appropriate responses to the event:
|
90 days |
Failed to send the FCM message to the FCM server |
4140 |
KLSRV_GCM_GENERAL_ERROR |
Events of this type occur due to unexpected errors on the Administration Server side when working with the Google Firebase Cloud Messaging HTTP protocol. Read the details in the event description and respond accordingly. If you cannot find the solution to an issue on your own, we recommend that you contact Kaspersky Technical Support. |
90 days |
Connection to the secondary Administration Server has been interrupted |
4116 |
KLSRV_EV_SLAVE_SRV_DISCONNECTED |
Events of this type occur when a connection to the secondary Administration Server is interrupted. Read the operating system log on the device where the secondary Administration Server is installed and respond accordingly. |
90 days |
Connection to the primary Administration Server has been interrupted |
4118 |
KLSRV_EV_MASTER_SRV_DISCONNECTED |
Events of this type occur when a connection to the primary Administration Server is interrupted. Read the operating system log on the device where the primary Administration Server is installed and respond accordingly. |
90 days |
Audit: Test connection to SIEM server failed |
5120 |
KLAUD_EV_SIEM_TEST_FAILED |
Events of this type occur when an automatic connection test to the SIEM server failed. |
90 days |
Administration Server informational events
The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Info importance level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Administration Server informational events
Event type display name |
Event type ID |
Event type |
Description |
Default storage term |
|---|---|---|---|---|
Over 90% of the license key is used up |
4097 |
KLSRV_EV_LICENSE_CHECK_90 |
Events of this type occur when Administration Server detects that some licensing limits are close to being exceeded by Kaspersky applications installed on client devices and if the number of currently used licensing units covered by a single license constitute over 90% of the total number of units covered by the license. Even when a licensing limit is exceeded, client devices are protected. You can respond to the event in the following ways:
Kaspersky Security Center Cloud Console determines the rules to generate events when a licensing limit is exceeded. |
30 days |
New device has been detected |
4100 |
KLSRV_EVENT_HOSTS_NEW_DETECTED |
Events of this type occur when new networked devices have been discovered. |
30 days |
Device has been automatically moved according to a rule |
4101 |
KLSRV_EVENT_HOSTS_NEW_REDIRECTED |
Events of this type occur when devices have been assigned to a group according to device moving rules. |
30 days |
Device has been removed from the group: inactive on the network for a long time |
4104 |
KLSRV_INVISIBLE_HOSTS_REMOVED |
Events of this type occur when devices have been automatically removed from a group for inactivity. |
30 days |
Limit of installations will soon be exceeded (more than 95% is used up) for one of the licensed applications groups |
4128 |
KLSRV_INVLICPROD_EXPIRED_SOON |
Events of this type occur when the number of installations for third-party applications included in a licensed applications group reaches 90% of the maximum allowed value specified in the license key properties. You can respond to the event in the following ways:
You can manage license keys of third-party applications using the functionality of licensed applications groups. |
30 days |
Files have been found to send to Kaspersky for analysis |
4131 |
KLSRV_APS_FILE_APPEARED |
|
30 days |
FCM Instance ID has changed on this mobile device |
4137 |
KLSRV_GCM_DEVICE_REGID_CHANGED |
Events of this type occur when the Firebase Cloud Messaging token has changed on the device. For information on the FCM token rotation, please refer to the Firebase service documentation. |
30 days |
Updates have been successfully copied to the specified folder |
4122 |
KLSRV_UPD_REPL_OK |
Events of this type occur when the Download updates to the Administration Server repository task finishes copying files to a specified folder. |
30 days |
Connection to the secondary Administration Server has been established |
4115 |
KLSRV_EV_SLAVE_SRV_CONNECTED |
Refer to the following topic for details: Creating a hierarchy of Administration Servers: adding a secondary Administration Server. |
30 days |
Connection to the primary Administration Server has been established |
4117 |
KLSRV_EV_MASTER_SRV_CONNECTED |
|
30 days |
Databases have been updated (In Kaspersky Security Center Cloud Console, this event type is available only for a secondary Administration Server.) |
4144 |
KLSRV_UPD_BASES_UPDATED |
Events of this type occur when the Download updates to the Administration Server repository task finishes updating databases. |
30 days |
KSN Proxy has started. KSN availability check has completed successfully |
7718 |
KSNPROXY_STARTED_CON_CHK_OK |
|
30 days |
KSN Proxy has stopped |
7720 |
KSNPROXY_STOPPED |
|
30 days |
Audit: Connection to the Administration Server has been established |
4147 |
KLAUD_EV_SERVERCONNECT |
|
30 days |
Audit: Object has been modified |
4148 |
KLAUD_EV_OBJECTMODIFY |
This event tracks changes in the following objects:
|
30 days |
Audit: Object status has changed |
4150 |
KLAUD_EV_TASK_STATE_CHANGED |
For example, this event occurs when a task has failed with an error. |
30 days |
Audit: Group settings have been modified |
4149 |
KLAUD_EV_ADMGROUP_CHANGED |
Events of this type occur when a security group has been edited. |
30 days |
Audit: Encryption keys have been imported or exported from Administration Server |
5100 |
KLAUD_EV_DPEKEYSEXPORT |
|
30 days |
Audit: Test connection to SIEM server succeeded |
5110 |
KLAUD_EV_SIEM_TEST_SUCCESS |
|
30 days |
Network Agent events
This section contains information about the events related to Network Agent.
Network Agent functional failure events
The table below shows the events of Kaspersky Security Center Network Agent that have the Functional failure severity level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Network Agent functional failure events
Event type display name |
Event type ID |
Event type |
Description |
Default storage term |
|---|---|---|---|---|
Update installation error |
7702 |
KLNAG_EV_PATCH_INSTALL_ERROR |
Events of this type occur if automatic updating and patching for Kaspersky Security Center Cloud Console components was not successful. The event does not concern updates of the managed Kaspersky applications. Read the event description. A Windows issue on the Administration Server might be a reason for this event. If the description mentions any issue of Windows configuration, resolve this issue. |
30 days |
Failed to install the third-party software update |
7697 |
KLNAG_EV_3P_PATCH_INSTALL_ERROR |
Events of this type occur if Vulnerability and patch management and Mobile Device Management features are in use, and if update of third-party software was not successful. Check whether the link to the third-party software is valid. Read the event description. |
30 days |
Failed to install the Windows Update updates |
7717 |
KLNAG_EV_WUA_INSTALL_ERROR |
Events of this type occur if Windows Updates were not successful. Configure Windows Updates in a Network Agent policy. Read the event description. Look for the error in the Microsoft Knowledge Base. Contact Microsoft Technical Support if you cannot resolve the issue yourself. |
30 days |
Network Agent warning events
The table below shows the events of Kaspersky Security Center Network Agent that have the Warning severity level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Network Agent warning events
Event type display name |
Event type ID |
Event type |
Default storage term |
|---|---|---|---|
Warning has been returned during installation of the software module update |
7701 |
KLNAG_EV_PATCH_INSTALL_WARNING |
30 days |
Third-party software update installation has completed with a warning |
7696 |
KLNAG_EV_3P_PATCH_INSTALL_WARNING |
30 days |
Third-party software update installation has been postponed |
7698 |
KLNAG_EV_3P_PATCH_INSTALL_SLIPPED |
30 days |
Security issue has occurred |
549 |
GNRL_EV_APP_INCIDENT_OCCURED |
30 days |
KSN Proxy has started. Failed to check KSN for availability |
7718 |
KSNPROXY_STARTED_CON_CHK_FAILED |
30 days |
Network Agent informational events
The table below shows the events of Kaspersky Security Center Network Agent that have the Info severity level.
For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.
Network Agent informational events
Event type display name |
Event type ID |
Event type |
Default storage term |
|---|---|---|---|
Update for software modules has been installed successfully |
7699 |
KLNAG_EV_PATCH_INSTALLED_SUCCESSFULLY |
30 days |
Installation of update for software modules has started |
7700 |
KLNAG_EV_PATCH_INSTALL_STARTING |
30 days |
Application has been installed |
7703 |
KLNAG_EV_INV_APP_INSTALLED |
30 days |
Application has been uninstalled |
7704 |
KLNAG_EV_INV_APP_UNINSTALLED |
30 days |
Monitored application has been installed |
7705 |
KLNAG_EV_INV_OBS_APP_INSTALLED |
30 days |
Monitored application has been uninstalled |
7706 |
KLNAG_EV_INV_OBS_APP_UNINSTALLED |
30 days |
Third-party application has been installed |
7707 |
KLNAG_EV_INV_CMPTR_APP_INSTALLED |
30 days |
New device has been added |
7708 |
KLNAG_EV_DEVICE_ARRIVAL |
30 days |
Device has been removed |
7709 |
KLNAG_EV_DEVICE_REMOVE |
30 days |
Device has been detected |
7710 |
KLNAG_EV_NAC_DEVICE_DISCOVERED |
30 days |
Device has been authorized |
7711 |
KLNAG_EV_NAC_HOST_AUTHORIZED |
30 days |
Windows Desktop Sharing: File has been read |
7712 |
KLUSRLOG_EV_FILE_READ |
30 days |
Windows Desktop Sharing: File has been modified |
7713 |
KLUSRLOG_EV_FILE_MODIFIED |
30 days |
Windows Desktop Sharing: Application has been started |
7714 |
KLUSRLOG_EV_PROCESS_LAUNCHED |
30 days |
Windows Desktop Sharing: Started |
7715 |
KLUSRLOG_EV_WDS_BEGIN |
30 days |
Windows Desktop Sharing: Stopped |
7716 |
KLUSRLOG_EV_WDS_END |
30 days |
Third-party software update has been installed successfully |
7694 |
KLNAG_EV_3P_PATCH_INSTALLED_SUCCESSFULLY |
30 days |
Third-party software update installation has started |
7695 |
KLNAG_EV_3P_PATCH_INSTALL_STARTING |
30 days |
KSN Proxy has started. KSN availability check has completed successfully |
7719 |
KSNPROXY_STARTED_CON_CHK_OK |
30 days |
KSN Proxy has stopped |
7720 |
KSNPROXY_STOPPED |
30 days |