Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-7438: List of local windows events logged by Direct Audit Collector

Centrify DirectAudit ,  

28 September,16 at 12:14 AM

Applies to:
Centrify DirectAudit 3.3.1 on all platforms

Question: 
In purpose of setting up monitoring on the windows DA infrastructure, we need to get a listing of Error Codes / Event IDs & their Messages, listed in order of criticality for the Collector Service.

Answer:
Here's the list of local Windows events logged by the collector service.

Windows log location - Application

Source name - DirectAudit Collector

Event ID

Type

Level

2000

A Collector upgrade is available. Please run Centrify DirectAudit setup to perform the upgrade.

INFORMATION

2001

Collector must be upgraded to connect to this Audit Store. Please run Centrify DirectAudit setup to perform the upgrade.

ERROR

2002

Database is in an earlier version and is not compatible to this version of Collector. Please contact Centrify Technical Support.

ERROR

2003

Database is in an earlier version and is not compatible to this version of Collector. Database must be upgraded for this Collector to send data to it. Please run Centrify DirectAudit setup to perform the upgrade.

ERROR

2004

The collector is now sending data to database '<PLACEHOLDER>'

INFORMATION

2005

This collector is not associated with any Installation. Please run the DirectAudit Collector Configuration Wizard

WARNING

2006

This collector is configured via <PLACEHOLDER> for Installation '<PLACEHOLDER>'

INFORMATION

2007

This collector is not associated with any Audit Store. Please run the DirectAudit Collector Configuration Wizard and/or reconfigure the scope of an Audit Store to include the site or subnet of this computer

WARNING

2008

The collector is using DirectAudit Audit Store '<PLACEHOLDER>'

INFORMATION

2009

Collector encounters serious error and is stopped. Please check Windows Application Log for detailed information.

ERROR

2010

The collector can only be run under the 'Local System' account. It is currently configured to run under the account '<PLACEHOLDER>'. Please use the Services control panel to reconfigure the Collector.

ERROR

2011

Problem starting <PLACEHOLDER>: <PLACEHOLDER>

ERROR

2012

Problem stopping <PLACEHOLDER>: <PLACEHOLDER>

ERROR

2013

AuditStore '<PLACEHOLDER>' disk space is low, the collector is not accepting audit data

ERROR

2014

AuditStore '<PLACEHOLDER>' is stopped or paused and not reachable, the collector is not accepting audit data.

INFORMATION

2015

DirectAudit Collector TCP port <PLACEHOLDER> is not available, the collector is not accepting audit data.

ERROR

2016

Audit Store database version is compatible with Collector version.

INFORMATION

2017

AuditStore '<PLACEHOLDER>' is full, the collector is not accepting audit data.

ERROR

2018

<PLACEHOLDER> stopped

INFORMATION

2019

Unable to resolve or record user's host name: <PLACEHOLDER>

INFORMATION

2020

Failed to complete the SQL statement: <PLACEHOLDER>

INFORMATION

2021

Centrify DirectAudit error processing packet: <PLACEHOLDER>

INFORMATION

2022

Centrify DirectAudit collector detected the incoming Unix data from <PLACEHOLDER> is corrupt. The corrupted data packet is being dropped. <PLACEHOLDER>

INFORMATION

2023

Unable to process Unix incoming data. Full text search feature and command detection will not be supported.

INFORMATION

2024

Centrify DirectAudit collector failed to process the incoming Unix data from <PLACEHOLDER>. The full text search and command detection features may not be functioning correctly <PLACEHOLDER>.

INFORMATION

2025

Unable to resolve or record user's host name: <PLACEHOLDER>

INFORMATION

2026

<PLACEHOLDER> is started.

INFORMATION

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.