Syslog documentation - Devolutions Documentation

The following information describes the message type and the subtype of records sent from Devolutions Server to a syslog server.

Message type

Unknown = 0
Info = 1
Warning = 2
Error = 3
OpenConnection = 4
AddConnection = 5
EditConnection = 6
DeleteConnection = 7
OpenVPN = 8
CloseVPN = 9
CredentialsSentToPlugin = 10
Comment = 11
ExportedConnection = 12
UserAdded = 13
UserDeleted = 14
UserEdited = 0xF
SecurityGroupAdded = 0x10
SecurityGroupDeleted = 17
SecurityGroupEdited = 18
RoleAdded = 19
RoleDeleted = 20
RoleEdited = 21
MacroScriptTool = 22
ExportedDocuments = 23
KeyAgentKeyUsed = 24
ReportOpened = 25
RepositoryAdded = 26
RepositoryDeleted = 27
RepositoryEdited = 28
AttachmentAdded = 29
AttachmentDeleted = 30
AttachmentEdited = 0x1F
AttachmentDocumentUpdated = 0x20
AttachmentOpened = 33
ActivityLogCleared = 34
DeletedEntryCleared = 35
EntryHistoryCleared = 36
DataSourcePermissionChanged = 37
ServerPropertiesViewed = 38
ServerPropertiesEdited = 39
ServerUpdated = 40
DocumentUpdated = 41
PasswordViewed = 43
PasswordChanged = 44
ConnectionStringViewed = 45
PasswordHistoryCleared = 46
ConnectionViewed = 47
ShortcutAdded = 48
ShortcutDeleted = 49
PasswordTemplateAdded = 50
PasswordTemplateEdited = 51
PasswordTemplateDeleted = 52
ResetPassword = 53
Checkout = 54
Checkin = 55
PermissionChanged = 56
Validation = 57
PamPasswordViewed = 58
PamCredentialAdded = 59
PamCredentialEdited = 60
PamCredentialDeleted = 61
TypingMacroExecuted = 62
TerminalScriptExecuted = 0x3F
ConnectionCopied = 0x40
ConnectionHistoryVersionReset = 65
AccessDenied = 66
PamCertificateViewed = 67
PamTagAdded = 68
PamTagRead = 69
PamTagEdited = 70
PamTagDeleted = 71
PamTagDeleteAssociatedTags = 72
PamTagDeleteUnusedTags = 73
PamResetPasswordScheduleAdded = 74
PamResetPasswordScheduleRead = 75
PamResetPasswordScheduleEdited = 76
PamResetPasswordScheduleDeleted = 77
PamPasswordUpdated = 78
PamFolderAdded = 79
PamFolderRead = 80
PamFolderEdited = 81
PamFolderDeleted = 82
PamCredentialRead = 83
PamCheckoutAdded = 84
PamCheckoutRead = 85
PamCheckoutEdited = 86
PamCheckoutDeleted = 87
PamCheckoutStatusChanged = 88
PamCheckoutAborted = 89
PamCheckoutExpired = 90
UserResetPassword = 91
PamPasswordHistoryViewed = 92
LicenseAdded = 93
LicenseDeleted = 94
LicenseEdited = 95
PamCheckoutEnded = 96
PamCheckoutApproved = 97
PamCheckoutDenied = 98
PamCheckoutActive = 99
SessionRecordingViewed = 100
UsernameViewed = 101
DomainViewed = 102
UserLicenseAssigned = 103
UserLicenseUnassigned = 104
PamCredentialSync = 105
PamPasswordReset = 106
PamPasswordBrokering = 107
RecordingInterrupted = 108
ExportedAllConnections = 109
PamFolderExported = 110
VaultMasterPasswordChanged = 111
OneTimePasswordViewed = 112
PamCheckoutCancelled = 113
PamCheckoutForcedCheckin = 114
UserLocked = 115
TemporaryAccessRequestSent = 116
TemporaryAccessRequestApproved = 117
TemporaryAccessRequestCancelled = 118
TemporaryAccessRequestDenied = 119
AddTemplate = 120
EditTemplate = 121
DeleteTemplate = 122
PamCheckoutPolicyAdded = 123
PamCheckoutPolicyEdited = 124
PamCheckoutPolicyDeleted = 125
SensitiveDataViewed = 126
PamOtpTemplateAdded = 0x7F
PamOtpTemplateEdited = 0x80
PamOtpTemplateDeleted = 129
PamPasswordPropagation = 130
EntryResurrectionFailed = 131
ExportedDocumentation = 132
EditedUserSpecificSettings = 133
RemovedUserSpecificSettings = 134
EmergencyCodeLogin = 135
PamVaultAdded = 136
PamVaultEdited = 137
PamVaultDeleted = 138
PamVaultExported = 139
UserResetMFA = 140

MessageSub type

PasswordAnalyzer = 2501
AdministrationLogs = 2502
ConnectedUserList = 2503
ConnectionExpiredEntry = 2504
DeletedEntries = 2505
LastUsageLog = 2506
SharedConnectionLog = 2507
LoginHistory = 2508
LoginAttempt = 2509
ServerLogs = 2510
OpenedConnections = 2511
CopiedPasswordToClipboard = 4301
RequestedForWebEdit = 4302
DontHaveRight = 6600
UserIsNotFoundOrIncorrectPassword = 6601
InvalidAttachmentId = 6602
CantAccessAnotherUsersRoamingSetting = 6603
DatabaseUsersAreNotAllowed = 6604
DomainUsersAreNotAllowed = 6605
CustomUsersAreNotAllowed = 6606
LocalMachineUsersAreNotAllowed = 6607
NotAllowedToSaveUser = 6608
CannotDeleteEntry = 6609
InvalidRepositoryId = 6610
CannotSaveRole = 6611
NotAllowedToChangePassword = 6612
NotAllowedToSaveRole = 6613
IncorrectUserType = 6614
NotAllowedToManageAttachments = 6615
NotAllowedToAddInFolder = 6616
NotAllowedToSaveEntry = 6617
NotAllowedToDeleteEntry = 6618
NotAllowedToCheckin = 6619
NotAllowedToGetTwoFactorInformation = 6620
NotAllowedToViewAttachment = 6621
NotTheUsersPrivateVault = 6622
NotAllowedToDeleteEntryHistory = 6623
LicenseDoesNotAllowEntryInteraction = 6624
MustBeAnAdministrator = 6625
NotAllowedToViewEntry = 6626
EntryNotFound = 6627
NoAllowedToViewEntryHistory = 6628
NotAllowedToCheckoutEntry = 6629
NotAllowedToGetCheckoutInformation = 6630
NotAllowedToGetCheckoutsForUser = 6631
NotAllowedToManageHandbooks = 6632
NotAllowedToGetHandbookPages = 6633
NotAllowedToViewLogs = 6634
NotAllowedToViewPasswordHistory = 6635
UserSpecificSettingsNotAllowed = 6636
InvalidConnectionId = 6637
NotAllowedToViewDeletedEntries = 6638
NotAllowedToViewTemplates = 6639
NotAllowedToCopyToClipboard = 6640
NotAllowedToViewPassword = 6641
NotAllowedToManageUsers = 6642
NotAllowedToResetPassword = 6643
OnlyRecipientCanDeleteAttachement = 6644
InvalidAccessToken = 6645
CantReleaseAnotherUsersLock = 6646
UserDoesNotHaveAccessToVault = 6647
OnlyRecipientCanSaveSecureAttachment = 6648
OnlyRecipientCanReadSecureMessage = 6649
TwoFactorNotConfigured = 6650

Samples of syslog records

Deleting an RDP entry

Jul 26 13:51:41 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry deleted - MessageType: 7, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:45 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Creating an RDP entry

Jul 26 13:51:37 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry created - MessageType: 5, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:41 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Opening an RDP entry and a VPN connection

Jul 26 13:47:24 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Opened session - MessageType: 4, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:28 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: True, CloseMode: , OpenMode: 0, ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: True, RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Jul 26 13:47:21 10.3.1.4 Devolutions[Server] PersonalConnection - [5] VPN opened - MessageType: 8, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:25 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Connection refused to resource

Jul 26 13:46:19 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Access denied - Not allowed to view entry - MessageType: 66, MessageSubType: 6626, UserName: banderson@windjammer.co, MachineName: 123.123.123.123, ConnectionName: , ConnectionTypeName: , ConnectionID: , ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:46:19 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: , Comment: , LoggedUserName: banderson@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: Web, ClientVersion: 2022.2.6.0 , IsEmbedded: , RepositoryID: , PamCredentialID: [ClientIP: 123.123.123.123]