Events available for reports

The following table provides an overview on all events which can be selected for logging.

Category Event ID Description
System 1001 Process started.
System 1005 Service started.
System 1005 Service started.
System 1006 Service start failed.
System 1007 Service stopped.
System 1007 Service stopped.
System 1016 Integrity test of data files failed.
System 1017 Logging destination not available.
System 1018 Unauthorized attempt to uninstall SafeGuard Enterprise.
System 1019 key backup failed
System 1020 Sending "key backup complete" to Sophos Enterprise Console failed.
System 1021 key backup not acknowledged
Communication 1500 Email was sent with attachments (From, Subject, Encryption method)
Communication 1507 Email was sent with attachments (From, Subject, Attachments, Encryption method)
Communication 1508 Email was sent with attachments (From, Recipients, Subject, Attachments, Encryption method)
Authentication 2001 External GINA identified and integrated successfully.
Authentication 2002 External GINA identified, integration failed.
Authentication 2003 Power-on Authentication active.
Authentication 2003 Power-on Authentication active.
Authentication 2004 Power-on Authentication deactivated.
Authentication 2004 Power-on Authentication deactivated.
Authentication 2005 Wake on LAN activated.
Authentication 2005 Wake on LAN activated.
Authentication 2006 Wake on LAN deactivated.
Authentication 2006 Wake on LAN deactivated.
Authentication 2007 Challenge created.
Authentication 2007 Challenge created.
Authentication 2008 Response created.
Authentication 2008 Response created.
Authentication 2009 Logon successful.
Authentication 2009 Logon successful.
Authentication 2009 Logon successful.
Authentication 2010 Logon failed.
Authentication 2010 Logon failed.
Authentication 2010 Logon failed.
Authentication 2011 User imported during logon and marked as owner.
Authentication 2012 User imported by owner and marked as non-owner.
Authentication 2013 User imported by non-owner and marked as non-owner.
Authentication 2014 User removed as owner.
Authentication 2015 Import of user during logon failed.
Authentication 2016 User logged off.
Authentication 2017 User was forced to log off.
Authentication 2018 Action performed on device.
Authentication 2018 Action performed on device.
Authentication 2019 User started a Password/PIN change.
Authentication 2019 User started a Password/PIN change.
Authentication 2020 User changed their password/PIN after logon.
Authentication 2020 User changed their password/PIN after logon.
Authentication 2021 Password/PIN quality.
Authentication 2022 Password/PIN policy violated.
Authentication 2023 LocalCache was corrupted and has been restored.
Authentication 2024 Invalid Password Black List Configuration.
Authentication 2025 Response code that allows the user to display the password received.
Authentication 2025 Response code that allows the user to display the password received.
Authentication 2026 Local cache backup completed successfully.
Authentication 2027 Local cache backup failed.
Authentication 2028 The logged on user is guest user.
Authentication 2029 Successful logon to Web Helpdesk with preconfigured credentials.
Authentication 2030 Logged on user is a Service Account.
Authentication 2031 Logon to Web Helpdesk with preconfigured credentials failed.
Authentication 2032 Authorization for Web Helpdesk failed.
Authentication 2033 Web Helpdesk started.
Authentication 2035 Service Account List imported.
Authentication 2036 Service Account List deleted.
Authentication 2056 SGN Windows user added.
Authentication 2057 All SGN Windows users have been removed from a machine.
Authentication 2057 All SGN Windows users have been removed from a machine.
Authentication 2058 Manual UMA user removal has been performed.
Authentication 2061 Computrace check return code.
Authentication 2062 Computrace check could not be executed.
Authentication 2071 Kernel initialization was successfully completed.
Authentication 2072 Kernel initialization has failed.
Authentication 2073 Machine keys were successfully generated on the client.
Authentication 2074 Machine keys could not be generated successfully on the client.
Authentication 2075 Querying disk properties or Opal disk initialization has failed.
Authentication 2079 Importing user into the kernel was successfully completed.
Authentication 2080 Removing user from the kernel was successfully completed.
Authentication 2081 Importing user into the kernel has failed.
Authentication 2082 Removing user from the kernel has failed.
Authentication 2083 Response with "display user password" created.
Authentication 2083 Response with "display user password" created.
Authentication 2084 Response for virtual client created.
Authentication 2084 Response for virtual client created.
Authentication 2085 Response for standalone client created.
Authentication 2085 Response for standalone client created.
Authentication 2086 For a standalone client user a new certificate was generated.
Authentication 2087 A certificate was assigned to a standalone client user. This event can only occur on standalone clients and thus will never be logged to the database.
Authentication 2095 Wake on LAN could not be activated.
Authentication 2096 Wake on LAN could not be deactivated.
Authentication 2097 The user has logged in to the client using the standby token for the first time. The standby token was set as standard token.
Authentication 2098 A successful standby certificate activation has been reported to the server.
Authentication 2099 The user has logged in to the client using the standby token for the first time. The standby certificate could not be activated because of an error.
Authentication 2100 The standby certificate activation has failed on the server
Authentication 2101 The pin on the token has been changed
Authentication 2102 PIN change on token failed
Authentication 2103 Unable to enforce policy "Enforce certificate based token logon"
Authentication 2104 Policy "Enable certificate based token logon" enforced
Administration 2500 SafeGuard Enterprise Administration started.
Administration 2500 SafeGuard Enterprise Administration started.
Administration 2501 Logon to SafeGuard Enterprise Administration failed.
Administration 2502 Authorization for SafeGuard Enterprise Administration failed.
Administration 2502 Authorization for SafeGuard Enterprise Administration failed.
Administration 2503 Additional authorization required.
Administration 2504 Additional authorization for action granted.
Administration 2505 Additional authorization failed.
Administration 2506 Data import from directory successful.
Administration 2506 Data import from directory successful.
Administration 2507 Data import from directory cancelled.
Administration 2508 Failed to import data from directory.
Administration 2508 Failed to import data from directory.
Administration 2511 User created.
Administration 2513 User changed.
Administration 2513 User changed.
Administration 2515 User deleted.
Administration 2515 User deleted.
Administration 2518 Application of user failed.
Administration 2522 Failed to delete user.
Administration 2522 Failed to delete user.
Administration 2525 Machine applied.
Administration 2529 Machine deleted.
Administration 2529 Machine deleted.
Administration 2532 Application of machine failed.
Administration 2536 Failed to delete machine.
Administration 2536 Failed to delete machine.
Administration 2539 OU applied.
Administration 2539 OU applied.
Administration 2543 OU deleted.
Administration 2543 OU deleted.
Administration 2546 Application of OU failed.
Administration 2547 Import of OU failed.
Administration 2550 Failed to delete OU.
Administration 2550 Failed to delete OU.
Administration 2553 Group applied.
Administration 2553 Group applied.
Administration 2555 Group modified.
Administration 2556 Group renamed.
Administration 2557 Group deleted.
Administration 2557 Group deleted.
Administration 2560 Application of group failed.
Administration 2560 Application of group failed.
Administration 2562 Failed to change group.
Administration 2563 Failed to rename group.
Administration 2564 Failed to delete group.
Administration 2564 Failed to delete group.
Administration 2573 Members added to group.
Administration 2575 Members deleted from group.
Administration 2576 Failed to add members to group.
Administration 2578 Failed to delete members from group.
Administration 2580 Group switched from OU to OU.
Administration 2583 Failed to switch group from OU to OU.
Administration 2591 Objects added to group.
Administration 2591 Objects added to group.
Administration 2593 Objects deleted from group.
Administration 2593 Objects deleted from group.
Administration 2594 Failed to add objects to group.
Administration 2594 Failed to add objects to group.
Administration 2596 Failed to delete objects from group.
Administration 2596 Failed to delete objects from group.
Administration 2603 Key generated.
Administration 2603 Key generated.
Administration 2603 Key generated.
Administration 2604 Key modified.
Administration 2604 Key modified.
Administration 2607 Key assigned.
Administration 2607 Key assigned.
Administration 2607 Key assigned.
Administration 2608 Key assignment cancelled.
Administration 2609 Failed to generate key.
Administration 2609 Failed to generate key.
Administration 2609 Failed to generate key.
Administration 2610 Failed to modify key.
Administration 2610 Failed to modify key.
Administration 2613 Failed to assign key.
Administration 2613 Failed to assign key.
Administration 2613 Failed to assign key.
Administration 2614 Failed to delete assignment of key.
Administration 2615 Certificate generated.
Administration 2615 Certificate generated.
Administration 2615 Certificate generated.
Administration 2616 Certificate imported.
Administration 2616 Certificate imported.
Administration 2619 Certificate deleted.
Administration 2619 Certificate deleted.
Administration 2621 Certificate assigned to user.
Administration 2622 Certificate assignment to user cancelled.
Administration 2623 Failed to create certificate.
Administration 2624 Failed to import certificate.
Administration 2624 Failed to import certificate.
Administration 2627 Failed to delete certificate.
Administration 2627 Failed to delete certificate.
Administration 2628 Extension of certificate failed.
Administration 2629 Failed to assign certificate to user.
Administration 2630 Failed to delete assignment of certificate to user.
Administration 2630 Failed to delete assignment of certificate to user.
Administration 2631 Token plugged in.
Administration 2631 Token plugged in.
Administration 2632 Token removed.
Administration 2633 Token issued to user.
Administration 2633 Token issued to user.
Administration 2634 Change user PIN on token.
Administration 2634 Change user PIN on token.
Administration 2635 Change SO PIN on token.
Administration 2635 Change SO PIN on token.
Administration 2636 Token locked.
Administration 2637 Token unlocked.
Administration 2638 Token deleted.
Administration 2638 Token deleted.
Administration 2639 Token assignment for user removed.
Administration 2640 Failed to issue token for user.
Administration 2640 Failed to issue token for user.
Administration 2641 Failed to change user PIN on token.
Administration 2641 Failed to change user PIN on token.
Administration 2642 Failed to change SO PIN on token.
Administration 2642 Failed to change SO PIN on token.
Administration 2643 Failed to lock token.
Administration 2644 Failed to unlock token.
Administration 2645 Failed to delete token.
Administration 2645 Failed to delete token.
Administration 2647 Policy created.
Administration 2648 Policy changed.
Administration 2650 Policy deleted.
Administration 2651 Policy assigned and activated to OU.
Administration 2652 Assigned policy removed from OU.
Administration 2653 Failed to create policy.
Administration 2654 Failed to change policy.
Administration 2657 Failed to assign and activate a policy to OU.
Administration 2658 Removing of assigned policy from OU failed.
Administration 2659 Policy group created.
Administration 2660 Policy group changed.
Administration 2661 Policy group deleted.
Administration 2662 Failed to create policy group.
Administration 2663 Failed to change policy group.
Administration 2665 Following policy has been added to policy group.
Administration 2667 Following policy has been deleted from policy group.
Administration 2668 Failed to add policy to policy group.
Administration 2670 Failed to delete policy from policy group.
Administration 2678 Recorded event exported.
Administration 2678 Recorded event exported.
Administration 2679 Export of recorded events failed.
Administration 2680 Recorded events deleted.
Administration 2680 Recorded events deleted.
Administration 2681 Failed to delete recorded events.
Administration 2681 Failed to delete recorded events.
Administration 2684 Security Officer allows renewal of certificate.
Administration 2684 Security Officer allows renewal of certificate.
Administration 2685 Security Officer denies renewal of certificate.
Administration 2685 Security Officer denies renewal of certificate.
Administration 2686 Failed to alter renewal settings for certificate.
Administration 2687 Officer certificate changed.
Administration 2688 Failed to change officer certificate.
Administration 2692 Creation of workgroups.
Administration 2692 Creation of workgroups.
Administration 2693 Failed creation of workgroups.
Administration 2693 Failed creation of workgroups.
Administration 2694 Deletion of workgroups.
Administration 2694 Deletion of workgroups.
Administration 2695 Failed deletion of workgroups.
Administration 2695 Failed deletion of workgroups.
Administration 2696 Creation of users.
Administration 2697 Failed creation of users.
Administration 2698 Creation of machines.
Administration 2699 Failed creation of machines.
Administration 2700 License is violated.
Administration 2701 Key file has been created.
Administration 2702 Key for key file has been deleted.
Administration 2702 Key for key file has been deleted.
Administration 2703 A Security Officer disabled power-on authentication in policy.
Administration 2704 LSH Question Theme created.
Administration 2705 LSH Question Theme changed.
Administration 2706 LSH Question Theme deleted.
Administration 2707 Question changed.
Administration 2708 Configuration package for standalone client created.
Administration 2709 Configuration package for Enterprise Client created.
Administration 2710 CCO has been imported.
Administration 2711 CCO has been exported.
Administration 2712 CCO has been deleted.
Administration 2713 Update of the company certificate.
Administration 2715 Service Account List created.
Administration 2716 Service Account List modified.
Administration 2717 Service Account List deleted.
Administration 2718 Cloud Storage Definition created.
Administration 2719 Cloud Storage Definition modified.
Administration 2720 Cloud Storage Definition deleted.
Administration 2721 Application List created.
Administration 2722 Application List modified.
Administration 2723 Application List deleted.
Administration 2724 Role created.
Administration 2725 Role modified.
Administration 2726 Role deleted.
Administration 2727 Role assigned to Security Officer.
Administration 2728 Role unassigned from Security Officer.
Administration 2729 Master Security Officer created.
Administration 2730 Master Security Officer modified.
Administration 2731 Master Security Officer deleted.
Administration 2732 Master Security Officer certificate changed.
Administration 2733 Master Security Officer certificate change failed.
Administration 2734 Master Security Officer enabled.
Administration 2735 Master Security Officer disabled.
Administration 2736 Security Officer created.
Administration 2737 Security Officer modified.
Administration 2738 Security Officer deleted.
Administration 2739 Security Officer deleted. Additional information about the children.
Administration 2740 Security Officer enabled.
Administration 2741 Security Officer disabled.
Administration 2742 Security Officer moved.
Administration 2743 Security Officer promoted.
Administration 2744 Security Officer promoted. Additional information about the children.
Administration 2745 Master Security Officer demoted.
Administration 2746 Security Officer Group created.
Administration 2747 Security Officer Group modified.
Administration 2748 Security Officer Group deleted.
Administration 2749 Security Officer added to Security Officer Group.
Administration 2750 Security Officer removed from Security Officer Group.
Administration 2753 Read access to container granted for Security Officer.
Administration 2754 Read access to container granted for Security Officer Group.
Administration 2755 Full access to container granted for Security Officer.
Administration 2756 Full access to container granted for Security Officer Group.
Administration 2757 Access to container revoked for Security Officer.
Administration 2758 Access to container revoked for Security Officer Group.
Administration 2759 Read access to policy granted for Security Officer.
Administration 2760 Read access to policy granted for Security Officer Group.
Administration 2761 Full access to policy granted for Security Officer.
Administration 2762 Full access to policy granted for Security Officer Group.
Administration 2763 Access to policy revoked for Security Officer.
Administration 2764 Read access to policy revoked for Security Officer Group.
Administration 2765 LSH Question number parameters changed.
Administration 2765 LSH Question number parameters changed.
Administration 2766 Access to container explicitly denied for Security Officer.
Administration 2767 Explicitly denied access to container revoked for Security Officer.
Administration 2768 Read access to container revoked for Security Officer.
Administration 2769 File tracking viewer has been opened.
Administration 2770 Policy deployment enabled by security officer.
Administration 2771 Policy deployment disabled by security officer.
Administration 2772 Policy deployment enabled by license management.
Administration 2773 Policy deployment disabled by license management.
Administration 2800 The confirmation of unconfirmed user was successful.
Administration 2801 A user has not been automatically confirmed.
Administration 2810 POA user created.
Administration 2811 POA user  modified.
Administration 2812 POA user deleted.
Administration 2815 Creation of POA user failed.
Administration 2816 Modification of POA user failed.
Administration 2817 Deletion of POA user failed.
Administration 2820 POA group created.
Administration 2821 POA group modified.
Administration 2822 POA user group deleted.
Administration 2825 Creation of POA user group failed.
Administration 2826 Modification of POA user group failed.
Administration 2827 Deletion of POA group  failed.
Administration 2830 POA Group is assigned to container.
Administration 2831 Assigned POA Group removed from container.
Administration 2832 Groups are activated for the assignment of POA Group  to container.
Administration 2833 Failed to assign POA Group  to container.
Administration 2834 Removing of assigned POA Group from Container failed.
Administration 2835 Failed to activate groups for the assignment of POA Group to container.
Administration 2850 Scheduler service stopped due to an exception.
Administration 2851 Scheduler task executed successfully.
Administration 2852 Scheduler task failed.
Administration 2853 Scheduler task created or modified.
Administration 2854 Scheduler task deleted.
Administration 2855 The certificate signature algorithm for new certificates has been changed.
Administration 2856 The certificate key length for new certificates has been changed.
Administration 2857 The certificate validity period for new certificates has been changed.
Administration 2858 The database has been upgraded successfully
Administration 2859 The database upgrade failed
Administration 2900 Response for Configuration Protection suspension created
Administration 2900 Response for Configuration Protection suspension created
Administration 2905 BitLocker recovery key was exported for machine
Client 3003 Kernel backup succeeded.
Client 3005 Kernel restore first chance succeeded.
Client 3006 Kernel restore second chance succeeded.
Client 3007 Kernel backup failed.
Client 3008 Kernel restore failed.
Client 3009 Kernel backup failed.
Client 3010 Backup token from POA removed
Client 3011 Backup token added to POA
Client 3018 The delayed encryption encrypted a file.
Client 3019 The delayed encryption decrypted a file.
Client 3020 File tracking for removable media: a file has been created.
Client 3021 File tracking for removable media: a file has been renamed.
Client 3022 File tracking for removable media: a file has been deleted.
Client 3025 File tracking for cloud storage: a file has been created.
Client 3026 File tracking for cloud storage: a file has been renamed.
Client 3027 File tracking for cloud storage: a file has been deleted.
Client 3028 File tracking: a file has been encrypted manually.
Client 3029 File tracking: a file has been decrypted manually.
Client 3030 User has changed his LSH secrets after login.
Client 3035 LSH was activated
Client 3040 LSH was deactivated
Client 3045 LSH is available - Enterprise Client
Client 3046 LSH is available - Standalone Client
Client 3050 LSH is disabled - Enterprise Client
Client 3051 LSH isn't available - Standalone Client
Client 3055 The QST list (LSH questions) was changed
Client 3060 The user has changed his answers in LSH
Client 3070 Key backup saved to the specified network share.
Client 3071 Key backup could not be saved to the specified network share.
Client 3072 User turned off encryption.
Client 3080 Sophos UEFI boot entry has been repaired successfully.
Client 3081 Sophos UEFI boot entry repair failed.
Client 3082 The outlook add-in has been disabled although it is enabled in the SGN policy.
Client 3110 POA user imported into POA
Client 3111 POA user deleted from POA
Client 3116 Import of POA user into POA failed
Client 3117 Deletion of POA user from POA failed
Client 3200 Configuration Protection suspended.
Client 3201 Configuration Protection not suspended (wrong response).
Client 3202 Suspension of Configuration Protection ended by user.
Client 3203 Suspension of Configuration Protection ended (suspension time was over).
Client 3300 Master Application restarted
Client 3301 Master Application was unexpectedly terminated
Client 3302 Master Application restart failed
Client 3303 An unhandled exception caused a crash in the Master application.
Client 3304 Termination of unknown MasterApp failed.
Client 3405 Configuration Protection client failed to uninstall.
Client 3406 Configuration Protection client experienced an internal error.
Client 3407 Configuration Protection client detected a possible tampering event.
Client 3408 Configuration Protection client detected a possible tampering of event logs.
Client 3409 Wrong passphrase entered.
Encryption 3500 Hard disk was successfully prepared for BitLocker encryption.
Encryption 3501 Access denied to medium on drive.
Encryption 3502 Access denied to data file.
Encryption 3503 Sector-based initial encryption of drive started.
Encryption 3504 Sector-based initial encryption of drive started (fast mode)
Encryption 3505 Sector-based initial encryption of drive completed successfully.
Encryption 3506 Sector-based initial encryption of drive failed and closed.
Encryption 3507 Sector-based initial encryption of drive cancelled.
Encryption 3508 Sector-based initial encryption of drive failed.
Encryption 3509 Sector-based decryption of drive started.
Encryption 3510 Sector-based decryption of drive completed successfully.
Encryption 3511 Sector-based decryption of drive failed and closed.
Encryption 3512 Sector-based decryption of drive cancelled.
Encryption 3513 Sector-based decryption of drive failed.
Encryption 3514 File-based initial encryption on a drive started.
Encryption 3515 File-based initial encryption on a drive completed successfully.
Encryption 3516 File-based initial encryption on a drive failed and closed.
Encryption 3517 File-based initial encryption on a drive cancelled.
Encryption 3519 File-based decryption on a drive started.
Encryption 3520 File-based decryption on a drive closed successfully.
Encryption 3521 File-based decryption on a drive failed and closed.
Encryption 3522 File-based decryption on a drive cancelled.
Encryption 3524 Encryption of a file started.
Encryption 3525 Encryption of a file completed successfully.
Encryption 3526 Encryption of a file failed.
Encryption 3540 Decryption of a file started.
Encryption 3541 Decryption of a file completed successfully.
Encryption 3542 Decryption of a file failed.
Encryption 3543 Backup of boot key successful.
Encryption 3544 Maximum count of boot algorithms exceeded.
Encryption 3545 Read errors on KSA.
Encryption 3546 Disabling volumes according to the defined policies.
Encryption 3547 Warning: NTFS boot sector backup is missing on the volume.
Encryption 3548 The user has set new BitLocker credentials for starting up the computer.
Encryption 3549 The user tried to set new BitLocker credentials for starting up the computer but the operation failed.
Encryption 3559 Items from asynchronous encryption queue are missing.
Encryption 3560 Access Protection
Encryption 3561 Computer status has been changed to secure.
Encryption 3562 Computer is secure, but policy setting "Remove keys on compromised machines" is not enabled. No action was taken.
Encryption 3563 Computer is insecure, but policy setting "Remove keys on compromised machines" is not enabled. No action was taken.
Encryption 3570 Media Encryption Key assigned.
Encryption 3571 Media Passphrase Key assigned.
Encryption 3572 Media Passphrase Key created.
Encryption 3573 Media Passphrase Key imported.
Encryption 3574 Broken key table detected.
Encryption 3600 General encryption error.
Encryption 3601 Encryption error - Engine: Volume missing.
Encryption 3602 Encryption error - Engine: Volume offline.
Encryption 3603 Encryption error - Engine: Volume removed.
Encryption 3604 Encryption error - Engine: Volume bad.
Encryption 3605 This computer is insecure. You must take further action.
Encryption 3607 Encryption error - Encryption key missing.
Encryption 3610 Encryption error - Origin KSA area corrupt.
Encryption 3611 Encryption error - Backup KSA area corrupt.
Encryption 3612 Encryption error - Origin ESA area corrupt.
Encryption 3700 File Share discarded an invalid path in the policy.
Encryption 3701 A trusted application could not be found.
Encryption 3710 File Share encryption started.
Encryption 3711 File Share encryption finished successfully.
Encryption 3712 File Share encryption completed with errors.
Encryption 3713 File Share encryption was cancelled.
Encryption 3714 Initial encryption has finished.
Encryption 3715 Initial encryption has finished for path.
Encryption 3800 Cloud Storage discarded an invalid path in the policy.
Encryption 3900 Encryption of self-decrypting HTML5 file has finished successfully.
Encryption 3999 Preparation of hard disk for BitLocker encryption has failed
Access Control 4400 Port successfully approved.
Access Control 4401 Device successfully approved.
Access Control 4402 Storage successfully approved.
Access Control 4403 WLAN successfully approved.
Access Control 4404 Port removed successfully.
Access Control 4405 Device removed successfully.
Access Control 4406 Storage device removed successfully.
Access Control 4407 WLAN disconnected successfully.
Access Control 4408 Port restricted.
Access Control 4409 Device restricted.
Access Control 4410 Storage device restricted.
Access Control 4411 WLAN restricted.
Access Control 4412 Port blocked.
Access Control 4413 Device blocked.
Access Control 4414 Storage device blocked.
Access Control 4415 WLAN blocked.