Documentazione Syslog

Le informazioni seguenti descrivono il tipo di messaggio e il sottotipo dei record inviati da Devolutions Server a un server syslog.

Parti del syslog

Parti	Descrizioni	Esempio formattato
Livello di emergenza	Il livello di emergenza del log. Emergency: 8 Alert: 9 Critical: 10 Error: 11 Warning: 12 Notice: 13 Information: 14 Debug: 15	<13>
Timestamp	L'ora in cui è stato generato il log.	2025-08-21T11:14:33.301372-04:00
Indirizzo IP del server	L'indirizzo IP del server.	10.1.20.188
Nome dell'applicazione	Il nome dell'applicazione.	Devolutions Server
ID processo	Identificatore di processo dell'applicazione.	7764
ID categoria	Numero che indica la categoria del log. User: 0 Group: 1 Role: 2 Login: 3 Error: 4 Connection: 5 Enabled: 6 Disabled: 7 Heartbeat: 8 Entry: 9 PamCheckout: 10 PamPrivilegedAccount: 11 PamProvider: 12 PamTeamFolder: 13 SystemSettings: 14 Vault: 15 BackupJob: 16	[4]
Tipo di messaggio	Numero che indica il tipo di messaggio contenuto nel log. Veda l'elenco di seguito.	5
Sottotipo di messaggio	Numero che indica il sottotipo di messaggio contenuto nel log. Veda l'elenco di seguito.	2505
Indirizzi IP del client	L'indirizzo IP del client.	[ClientIP:fe80::1:1:1:1,1.1.2.18]

Tipo di messaggio

• Unknown = 0
• Info = 1
• Warning = 2
• Error = 3
• OpenConnection = 4
• AddConnection = 5
• EditConnection = 6
• DeleteConnection = 7
• OpenVPN = 8
• CloseVPN = 9
• CredentialsSentToPlugin = 10
• Comment = 11
• ExportedConnection = 12
• UserAdded = 13
• UserDeleted = 14
• UserEdited = 0xF
• SecurityGroupAdded = 0x10
• SecurityGroupDeleted = 17
• SecurityGroupEdited = 18
• RoleAdded = 19
• RoleDeleted = 20
• RoleEdited = 21
• MacroScriptTool = 22
• ExportedDocuments = 23
• KeyAgentKeyUsed = 24
• ReportOpened = 25
• RepositoryAdded = 26
• RepositoryDeleted = 27
• RepositoryEdited = 28
• AttachmentAdded = 29
• AttachmentDeleted = 30
• AttachmentEdited = 0x1F
• AttachmentDocumentUpdated = 0x20
• AttachmentOpened = 33
• ActivityLogCleared = 34
• DeletedEntryCleared = 35
• EntryHistoryCleared = 36
• DataSourcePermissionChanged = 37
• ServerPropertiesViewed = 38
• ServerPropertiesEdited = 39
• ServerUpdated = 40
• DocumentUpdated = 41
• PasswordViewed = 43
• PasswordChanged = 44
• ConnectionStringViewed = 45
• PasswordHistoryCleared = 46
• ConnectionViewed = 47
• ShortcutAdded = 48
• ShortcutDeleted = 49
• PasswordTemplateAdded = 50
• PasswordTemplateEdited = 51
• PasswordTemplateDeleted = 52
• ResetPassword = 53
• Checkout = 54
• Checkin = 55
• PermissionChanged = 56
• Validation = 57
• PamPasswordViewed = 58
• PamCredentialAdded = 59
• PamCredentialEdited = 60
• PamCredentialDeleted = 61
• TypingMacroExecuted = 62
• TerminalScriptExecuted = 0x3F
• ConnectionCopied = 0x40
• ConnectionHistoryVersionReset = 65
• AccessDenied = 66
• PamCertificateViewed = 67
• PamTagAdded = 68
• PamTagRead = 69
• PamTagEdited = 70
• PamTagDeleted = 71
• PamTagDeleteAssociatedTags = 72
• PamTagDeleteUnusedTags = 73
• PamResetPasswordScheduleAdded = 74
• PamResetPasswordScheduleRead = 75
• PamResetPasswordScheduleEdited = 76
• PamResetPasswordScheduleDeleted = 77
• PamPasswordUpdated = 78
• PamFolderAdded = 79
• PamFolderRead = 80
• PamFolderEdited = 81
• PamFolderDeleted = 82
• PamCredentialRead = 83
• PamCheckoutAdded = 84
• PamCheckoutRead = 85
• PamCheckoutEdited = 86
• PamCheckoutDeleted = 87
• PamCheckoutStatusChanged = 88
• PamCheckoutAborted = 89
• PamCheckoutExpired = 90
• UserResetPassword = 91
• PamPasswordHistoryViewed = 92
• LicenseAdded = 93
• LicenseDeleted = 94
• LicenseEdited = 95
• PamCheckoutEnded = 96
• PamCheckoutApproved = 97
• PamCheckoutDenied = 98
• PamCheckoutActive = 99
• SessionRecordingViewed = 100
• UsernameViewed = 101
• DomainViewed = 102
• UserLicenseAssigned = 103
• UserLicenseUnassigned = 104
• PamCredentialSync = 105
• PamPasswordReset = 106
• PamPasswordBrokering = 107
• RecordingInterrupted = 108
• ExportedAllConnections = 109
• PamFolderExported = 110
• VaultMasterPasswordChanged = 111
• OneTimePasswordViewed = 112
• PamCheckoutCancelled = 113
• PamCheckoutForcedCheckin = 114
• UserLocked = 115
• TemporaryAccessRequestSent = 116
• TemporaryAccessRequestApproved = 117
• TemporaryAccessRequestCancelled = 118
• TemporaryAccessRequestDenied = 119
• AddTemplate = 120
• EditTemplate = 121
• DeleteTemplate = 122
• PamCheckoutPolicyAdded = 123
• PamCheckoutPolicyEdited = 124
• PamCheckoutPolicyDeleted = 125
• SensitiveDataViewed = 126
• PamOtpTemplateAdded = 0x7F
• PamOtpTemplateEdited = 0x80
• PamOtpTemplateDeleted = 129
• PamPasswordPropagation = 130
• EntryResurrectionFailed = 131
• ExportedDocumentation = 132
• EditedUserSpecificSettings = 133
• RemovedUserSpecificSettings = 134
• EmergencyCodeLogin = 135
• PamVaultAdded = 136
• PamVaultEdited = 137
• PamVaultDeleted = 138
• PamVaultExported = 139
• UserResetMFA = 140

Sottotipo di messaggio

• PasswordAnalyzer = 2501
• AdministrationLogs = 2502
• ConnectedUserList = 2503
• ConnectionExpiredEntry = 2504
• DeletedEntries = 2505
• LastUsageLog = 2506
• SharedConnectionLog = 2507
• LoginHistory = 2508
• LoginAttempt = 2509
• ServerLogs = 2510
• OpenedConnections = 2511
• CopiedPasswordToClipboard = 4301
• RequestedForWebEdit = 4302
• DontHaveRight = 6600
• UserIsNotFoundOrIncorrectPassword = 6601
• InvalidAttachmentId = 6602
• CantAccessAnotherUsersRoamingSetting = 6603
• DatabaseUsersAreNotAllowed = 6604
• DomainUsersAreNotAllowed = 6605
• CustomUsersAreNotAllowed = 6606
• LocalMachineUsersAreNotAllowed = 6607
• NotAllowedToSaveUser = 6608
• CannotDeleteEntry = 6609
• InvalidRepositoryId = 6610
• CannotSaveRole = 6611
• NotAllowedToChangePassword = 6612
• NotAllowedToSaveRole = 6613
• IncorrectUserType = 6614
• NotAllowedToManageAttachments = 6615
• NotAllowedToAddInFolder = 6616
• NotAllowedToSaveEntry = 6617
• NotAllowedToDeleteEntry = 6618
• NotAllowedToCheckin = 6619
• NotAllowedToGetTwoFactorInformation = 6620
• NotAllowedToViewAttachment = 6621
• NotTheUsersPrivateVault = 6622
• NotAllowedToDeleteEntryHistory = 6623
• LicenseDoesNotAllowEntryInteraction = 6624
• MustBeAnAdministrator = 6625
• NotAllowedToViewEntry = 6626
• EntryNotFound = 6627
• NoAllowedToViewEntryHistory = 6628
• NotAllowedToCheckoutEntry = 6629
• NotAllowedToGetCheckoutInformation = 6630
• NotAllowedToGetCheckoutsForUser = 6631
• NotAllowedToManageHandbooks = 6632
• NotAllowedToGetHandbookPages = 6633
• NotAllowedToViewLogs = 6634
• NotAllowedToViewPasswordHistory = 6635
• UserSpecificSettingsNotAllowed = 6636
• InvalidConnectionId = 6637
• NotAllowedToViewDeletedEntries = 6638
• NotAllowedToViewTemplates = 6639
• NotAllowedToCopyToClipboard = 6640
• NotAllowedToViewPassword = 6641
• NotAllowedToManageUsers = 6642
• NotAllowedToResetPassword = 6643
• OnlyRecipientCanDeleteAttachement = 6644
• InvalidAccessToken = 6645
• CantReleaseAnotherUsersLock = 6646
• UserDoesNotHaveAccessToVault = 6647
• OnlyRecipientCanSaveSecureAttachment = 6648
• OnlyRecipientCanReadSecureMessage = 6649
• TwoFactorNotConfigured = 6650

Esempi di record syslog

Eliminazione di una voce RDP

Jul 26 13:51:41 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry deleted - MessageType: 7, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:45 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Creazione di una voce RDP

Jul 26 13:51:37 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry created - MessageType: 5, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:41 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Apertura di una voce RDP e di una connessione VPN

Jul 26 13:47:24 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Opened session - MessageType: 4, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:28 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: True, CloseMode: , OpenMode: 0, ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: True, RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Jul 26 13:47:21 10.3.1.4 Devolutions[Server] PersonalConnection - [5] VPN opened - MessageType: 8, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:25 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Connessione alla risorsa rifiutata

Jul 26 13:46:19 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Access denied - Not allowed to view entry - MessageType: 66, MessageSubType: 6626, UserName: banderson

@windjammer.co, MachineName: 123.123.123.123, ConnectionName: , ConnectionTypeName: , ConnectionID: , ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:46:19 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: , Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: Web, ClientVersion: 2022.2.6.0 , IsEmbedded: , RepositoryID: , PamCredentialID: [ClientIP: 123.123.123.123]