Documentation Syslog

Les informations suivantes décrivent le type de message et le sous-type des enregistrements envoyés depuis Devolutions Server vers un serveur syslog.

Parties du syslog

Parties	Descriptions	Exemple formaté
Niveau d'urgence	Le niveau d'urgence du journal. Emergency: 8 Alert: 9 Critical: 10 Error: 11 Warning: 12 Notice: 13 Information: 14 Debug: 15	<13>
Horodatage	L'heure à laquelle le journal a été généré.	2025-08-21T11:14:33.301372-04:00
Adresse IP du serveur	L'adresse IP du serveur.	10.1.20.188
Nom de l'application	Le nom de l'application.	Devolutions Server
ID de processus	Identifiant de processus de l'application.	7764
ID de catégorie	Nombre indiquant la catégorie du journal. User: 0 Group: 1 Role: 2 Login: 3 Error: 4 Connection: 5 Enabled: 6 Disabled: 7 Heartbeat: 8 Entry: 9 PamCheckout: 10 PamPrivilegedAccount: 11 PamProvider: 12 PamTeamFolder: 13 SystemSettings: 14 Vault: 15 BackupJob: 16	[4]
Type de message	Nombre indiquant le type de message que contient le journal. Voir la liste ci-dessous.	5
Sous-type de message	Nombre indiquant le sous-type de message que contient le journal. Voir la liste ci-dessous.	2505
Adresses IP du client	L'adresse IP du client.	[ClientIP:fe80::1:1:1:1,1.1.2.18]

Type de message

• Unknown = 0
• Info = 1
• Warning = 2
• Error = 3
• OpenConnection = 4
• AddConnection = 5
• EditConnection = 6
• DeleteConnection = 7
• OpenVPN = 8
• CloseVPN = 9
• CredentialsSentToPlugin = 10
• Comment = 11
• ExportedConnection = 12
• UserAdded = 13
• UserDeleted = 14
• UserEdited = 0xF
• SecurityGroupAdded = 0x10
• SecurityGroupDeleted = 17
• SecurityGroupEdited = 18
• RoleAdded = 19
• RoleDeleted = 20
• RoleEdited = 21
• MacroScriptTool = 22
• ExportedDocuments = 23
• KeyAgentKeyUsed = 24
• ReportOpened = 25
• RepositoryAdded = 26
• RepositoryDeleted = 27
• RepositoryEdited = 28
• AttachmentAdded = 29
• AttachmentDeleted = 30
• AttachmentEdited = 0x1F
• AttachmentDocumentUpdated = 0x20
• AttachmentOpened = 33
• ActivityLogCleared = 34
• DeletedEntryCleared = 35
• EntryHistoryCleared = 36
• DataSourcePermissionChanged = 37
• ServerPropertiesViewed = 38
• ServerPropertiesEdited = 39
• ServerUpdated = 40
• DocumentUpdated = 41
• PasswordViewed = 43
• PasswordChanged = 44
• ConnectionStringViewed = 45
• PasswordHistoryCleared = 46
• ConnectionViewed = 47
• ShortcutAdded = 48
• ShortcutDeleted = 49
• PasswordTemplateAdded = 50
• PasswordTemplateEdited = 51
• PasswordTemplateDeleted = 52
• ResetPassword = 53
• Checkout = 54
• Checkin = 55
• PermissionChanged = 56
• Validation = 57
• PamPasswordViewed = 58
• PamCredentialAdded = 59
• PamCredentialEdited = 60
• PamCredentialDeleted = 61
• TypingMacroExecuted = 62
• TerminalScriptExecuted = 0x3F
• ConnectionCopied = 0x40
• ConnectionHistoryVersionReset = 65
• AccessDenied = 66
• PamCertificateViewed = 67
• PamTagAdded = 68
• PamTagRead = 69
• PamTagEdited = 70
• PamTagDeleted = 71
• PamTagDeleteAssociatedTags = 72
• PamTagDeleteUnusedTags = 73
• PamResetPasswordScheduleAdded = 74
• PamResetPasswordScheduleRead = 75
• PamResetPasswordScheduleEdited = 76
• PamResetPasswordScheduleDeleted = 77
• PamPasswordUpdated = 78
• PamFolderAdded = 79
• PamFolderRead = 80
• PamFolderEdited = 81
• PamFolderDeleted = 82
• PamCredentialRead = 83
• PamCheckoutAdded = 84
• PamCheckoutRead = 85
• PamCheckoutEdited = 86
• PamCheckoutDeleted = 87
• PamCheckoutStatusChanged = 88
• PamCheckoutAborted = 89
• PamCheckoutExpired = 90
• UserResetPassword = 91
• PamPasswordHistoryViewed = 92
• LicenseAdded = 93
• LicenseDeleted = 94
• LicenseEdited = 95
• PamCheckoutEnded = 96
• PamCheckoutApproved = 97
• PamCheckoutDenied = 98
• PamCheckoutActive = 99
• SessionRecordingViewed = 100
• UsernameViewed = 101
• DomainViewed = 102
• UserLicenseAssigned = 103
• UserLicenseUnassigned = 104
• PamCredentialSync = 105
• PamPasswordReset = 106
• PamPasswordBrokering = 107
• RecordingInterrupted = 108
• ExportedAllConnections = 109
• PamFolderExported = 110
• VaultMasterPasswordChanged = 111
• OneTimePasswordViewed = 112
• PamCheckoutCancelled = 113
• PamCheckoutForcedCheckin = 114
• UserLocked = 115
• TemporaryAccessRequestSent = 116
• TemporaryAccessRequestApproved = 117
• TemporaryAccessRequestCancelled = 118
• TemporaryAccessRequestDenied = 119
• AddTemplate = 120
• EditTemplate = 121
• DeleteTemplate = 122
• PamCheckoutPolicyAdded = 123
• PamCheckoutPolicyEdited = 124
• PamCheckoutPolicyDeleted = 125
• SensitiveDataViewed = 126
• PamOtpTemplateAdded = 0x7F
• PamOtpTemplateEdited = 0x80
• PamOtpTemplateDeleted = 129
• PamPasswordPropagation = 130
• EntryResurrectionFailed = 131
• ExportedDocumentation = 132
• EditedUserSpecificSettings = 133
• RemovedUserSpecificSettings = 134
• EmergencyCodeLogin = 135
• PamVaultAdded = 136
• PamVaultEdited = 137
• PamVaultDeleted = 138
• PamVaultExported = 139
• UserResetMFA = 140

Sous-type de message

• PasswordAnalyzer = 2501
• AdministrationLogs = 2502
• ConnectedUserList = 2503
• ConnectionExpiredEntry = 2504
• DeletedEntries = 2505
• LastUsageLog = 2506
• SharedConnectionLog = 2507
• LoginHistory = 2508
• LoginAttempt = 2509
• ServerLogs = 2510
• OpenedConnections = 2511
• CopiedPasswordToClipboard = 4301
• RequestedForWebEdit = 4302
• DontHaveRight = 6600
• UserIsNotFoundOrIncorrectPassword = 6601
• InvalidAttachmentId = 6602
• CantAccessAnotherUsersRoamingSetting = 6603
• DatabaseUsersAreNotAllowed = 6604
• DomainUsersAreNotAllowed = 6605
• CustomUsersAreNotAllowed = 6606
• LocalMachineUsersAreNotAllowed = 6607
• NotAllowedToSaveUser = 6608
• CannotDeleteEntry = 6609
• InvalidRepositoryId = 6610
• CannotSaveRole = 6611
• NotAllowedToChangePassword = 6612
• NotAllowedToSaveRole = 6613
• IncorrectUserType = 6614
• NotAllowedToManageAttachments = 6615
• NotAllowedToAddInFolder = 6616
• NotAllowedToSaveEntry = 6617
• NotAllowedToDeleteEntry = 6618
• NotAllowedToCheckin = 6619
• NotAllowedToGetTwoFactorInformation = 6620
• NotAllowedToViewAttachment = 6621
• NotTheUsersPrivateVault = 6622
• NotAllowedToDeleteEntryHistory = 6623
• LicenseDoesNotAllowEntryInteraction = 6624
• MustBeAnAdministrator = 6625
• NotAllowedToViewEntry = 6626
• EntryNotFound = 6627
• NoAllowedToViewEntryHistory = 6628
• NotAllowedToCheckoutEntry = 6629
• NotAllowedToGetCheckoutInformation = 6630
• NotAllowedToGetCheckoutsForUser = 6631
• NotAllowedToManageHandbooks = 6632
• NotAllowedToGetHandbookPages = 6633
• NotAllowedToViewLogs = 6634
• NotAllowedToViewPasswordHistory = 6635
• UserSpecificSettingsNotAllowed = 6636
• InvalidConnectionId = 6637
• NotAllowedToViewDeletedEntries = 6638
• NotAllowedToViewTemplates = 6639
• NotAllowedToCopyToClipboard = 6640
• NotAllowedToViewPassword = 6641
• NotAllowedToManageUsers = 6642
• NotAllowedToResetPassword = 6643
• OnlyRecipientCanDeleteAttachement = 6644
• InvalidAccessToken = 6645
• CantReleaseAnotherUsersLock = 6646
• UserDoesNotHaveAccessToVault = 6647
• OnlyRecipientCanSaveSecureAttachment = 6648
• OnlyRecipientCanReadSecureMessage = 6649
• TwoFactorNotConfigured = 6650

Exemples d'enregistrements syslog

Suppression d'une entrée RDP

Jul 26 13:51:41 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry deleted - MessageType: 7, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:45 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Création d'une entrée RDP

Jul 26 13:51:37 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry created - MessageType: 5, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:41 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Ouverture d'une entrée RDP et d'une connexion VPN

Jul 26 13:47:24 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Opened session - MessageType: 4, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:28 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: True, CloseMode: , OpenMode: 0, ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: True, RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Jul 26 13:47:21 10.3.1.4 Devolutions[Server] PersonalConnection - [5] VPN opened - MessageType: 8, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:25 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Connexion refusée à une ressource

Jul 26 13:46:19 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Access denied - Not allowed to view entry - MessageType: 66, MessageSubType: 6626, UserName: banderson

@windjammer.co, MachineName: 123.123.123.123, ConnectionName: , ConnectionTypeName: , ConnectionID: , ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:46:19 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: , Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: Web, ClientVersion: 2022.2.6.0 , IsEmbedded: , RepositoryID: , PamCredentialID: [ClientIP: 123.123.123.123]