Syslog documentation

The following information describes the message type and the subtype of records sent from Devolutions Server to a syslog server.

Syslog parts

Parts	Descriptions	Formatted example
Emergency level	The level of emergency of the log. Emergency: 8 Alert: 9 Critical: 10 Error: 11 Warning: 12 Notice: 13 Information: 14 Debug: 15	<13>
Timestamp	The time at which the log was generated.	2025-08-21T11:14:33.301372-04:00
Server IP address	The IP address of the server.	10.1.20.188
Application name	The name of the application.	Devolutions Server
Process ID	Process identifier of the application.	7764
Category ID	Number indicating the log's category. User: 0 Group: 1 Role: 2 Login: 3 Error: 4 Connection: 5 Enabled: 6 Disabled: 7 Heartbeat: 8 Entry: 9 PamCheckout: 10 PamPrivilegedAccount: 11 PamProvider: 12 PamTeamFolder: 13 SystemSettings: 14 Vault: 15 BackupJob: 16	[4]
Message type	Number indicating which type of message the log contains. See the list below.	5
Message subtype	Number indicating which subtype of message the log contains. See the list below.	2505
Client IP addresses	The IP address of the client.	[ClientIP:fe80::1:1:1:1,1.1.2.18]

Message type

• Unknown = 0
• Info = 1
• Warning = 2
• Error = 3
• OpenConnection = 4
• AddConnection = 5
• EditConnection = 6
• DeleteConnection = 7
• OpenVPN = 8
• CloseVPN = 9
• CredentialsSentToPlugin = 10
• Comment = 11
• ExportedConnection = 12
• UserAdded = 13
• UserDeleted = 14
• UserEdited = 0xF
• SecurityGroupAdded = 0x10
• SecurityGroupDeleted = 17
• SecurityGroupEdited = 18
• RoleAdded = 19
• RoleDeleted = 20
• RoleEdited = 21
• MacroScriptTool = 22
• ExportedDocuments = 23
• KeyAgentKeyUsed = 24
• ReportOpened = 25
• RepositoryAdded = 26
• RepositoryDeleted = 27
• RepositoryEdited = 28
• AttachmentAdded = 29
• AttachmentDeleted = 30
• AttachmentEdited = 0x1F
• AttachmentDocumentUpdated = 0x20
• AttachmentOpened = 33
• ActivityLogCleared = 34
• DeletedEntryCleared = 35
• EntryHistoryCleared = 36
• DataSourcePermissionChanged = 37
• ServerPropertiesViewed = 38
• ServerPropertiesEdited = 39
• ServerUpdated = 40
• DocumentUpdated = 41
• PasswordViewed = 43
• PasswordChanged = 44
• ConnectionStringViewed = 45
• PasswordHistoryCleared = 46
• ConnectionViewed = 47
• ShortcutAdded = 48
• ShortcutDeleted = 49
• PasswordTemplateAdded = 50
• PasswordTemplateEdited = 51
• PasswordTemplateDeleted = 52
• ResetPassword = 53
• Checkout = 54
• Checkin = 55
• PermissionChanged = 56
• Validation = 57
• PamPasswordViewed = 58
• PamCredentialAdded = 59
• PamCredentialEdited = 60
• PamCredentialDeleted = 61
• TypingMacroExecuted = 62
• TerminalScriptExecuted = 0x3F
• ConnectionCopied = 0x40
• ConnectionHistoryVersionReset = 65
• AccessDenied = 66
• PamCertificateViewed = 67
• PamTagAdded = 68
• PamTagRead = 69
• PamTagEdited = 70
• PamTagDeleted = 71
• PamTagDeleteAssociatedTags = 72
• PamTagDeleteUnusedTags = 73
• PamResetPasswordScheduleAdded = 74
• PamResetPasswordScheduleRead = 75
• PamResetPasswordScheduleEdited = 76
• PamResetPasswordScheduleDeleted = 77
• PamPasswordUpdated = 78
• PamFolderAdded = 79
• PamFolderRead = 80
• PamFolderEdited = 81
• PamFolderDeleted = 82
• PamCredentialRead = 83
• PamCheckoutAdded = 84
• PamCheckoutRead = 85
• PamCheckoutEdited = 86
• PamCheckoutDeleted = 87
• PamCheckoutStatusChanged = 88
• PamCheckoutAborted = 89
• PamCheckoutExpired = 90
• UserResetPassword = 91
• PamPasswordHistoryViewed = 92
• LicenseAdded = 93
• LicenseDeleted = 94
• LicenseEdited = 95
• PamCheckoutEnded = 96
• PamCheckoutApproved = 97
• PamCheckoutDenied = 98
• PamCheckoutActive = 99
• SessionRecordingViewed = 100
• UsernameViewed = 101
• DomainViewed = 102
• UserLicenseAssigned = 103
• UserLicenseUnassigned = 104
• PamCredentialSync = 105
• PamPasswordReset = 106
• PamPasswordBrokering = 107
• RecordingInterrupted = 108
• ExportedAllConnections = 109
• PamFolderExported = 110
• VaultMasterPasswordChanged = 111
• OneTimePasswordViewed = 112
• PamCheckoutCancelled = 113
• PamCheckoutForcedCheckin = 114
• UserLocked = 115
• TemporaryAccessRequestSent = 116
• TemporaryAccessRequestApproved = 117
• TemporaryAccessRequestCancelled = 118
• TemporaryAccessRequestDenied = 119
• AddTemplate = 120
• EditTemplate = 121
• DeleteTemplate = 122
• PamCheckoutPolicyAdded = 123
• PamCheckoutPolicyEdited = 124
• PamCheckoutPolicyDeleted = 125
• SensitiveDataViewed = 126
• PamOtpTemplateAdded = 0x7F
• PamOtpTemplateEdited = 0x80
• PamOtpTemplateDeleted = 129
• PamPasswordPropagation = 130
• EntryResurrectionFailed = 131
• ExportedDocumentation = 132
• EditedUserSpecificSettings = 133
• RemovedUserSpecificSettings = 134
• EmergencyCodeLogin = 135
• PamVaultAdded = 136
• PamVaultEdited = 137
• PamVaultDeleted = 138
• PamVaultExported = 139
• UserResetMFA = 140

MessageSub type

• PasswordAnalyzer = 2501
• AdministrationLogs = 2502
• ConnectedUserList = 2503
• ConnectionExpiredEntry = 2504
• DeletedEntries = 2505
• LastUsageLog = 2506
• SharedConnectionLog = 2507
• LoginHistory = 2508
• LoginAttempt = 2509
• ServerLogs = 2510
• OpenedConnections = 2511
• CopiedPasswordToClipboard = 4301
• RequestedForWebEdit = 4302
• DontHaveRight = 6600
• UserIsNotFoundOrIncorrectPassword = 6601
• InvalidAttachmentId = 6602
• CantAccessAnotherUsersRoamingSetting = 6603
• DatabaseUsersAreNotAllowed = 6604
• DomainUsersAreNotAllowed = 6605
• CustomUsersAreNotAllowed = 6606
• LocalMachineUsersAreNotAllowed = 6607
• NotAllowedToSaveUser = 6608
• CannotDeleteEntry = 6609
• InvalidRepositoryId = 6610
• CannotSaveRole = 6611
• NotAllowedToChangePassword = 6612
• NotAllowedToSaveRole = 6613
• IncorrectUserType = 6614
• NotAllowedToManageAttachments = 6615
• NotAllowedToAddInFolder = 6616
• NotAllowedToSaveEntry = 6617
• NotAllowedToDeleteEntry = 6618
• NotAllowedToCheckin = 6619
• NotAllowedToGetTwoFactorInformation = 6620
• NotAllowedToViewAttachment = 6621
• NotTheUsersPrivateVault = 6622
• NotAllowedToDeleteEntryHistory = 6623
• LicenseDoesNotAllowEntryInteraction = 6624
• MustBeAnAdministrator = 6625
• NotAllowedToViewEntry = 6626
• EntryNotFound = 6627
• NoAllowedToViewEntryHistory = 6628
• NotAllowedToCheckoutEntry = 6629
• NotAllowedToGetCheckoutInformation = 6630
• NotAllowedToGetCheckoutsForUser = 6631
• NotAllowedToManageHandbooks = 6632
• NotAllowedToGetHandbookPages = 6633
• NotAllowedToViewLogs = 6634
• NotAllowedToViewPasswordHistory = 6635
• UserSpecificSettingsNotAllowed = 6636
• InvalidConnectionId = 6637
• NotAllowedToViewDeletedEntries = 6638
• NotAllowedToViewTemplates = 6639
• NotAllowedToCopyToClipboard = 6640
• NotAllowedToViewPassword = 6641
• NotAllowedToManageUsers = 6642
• NotAllowedToResetPassword = 6643
• OnlyRecipientCanDeleteAttachement = 6644
• InvalidAccessToken = 6645
• CantReleaseAnotherUsersLock = 6646
• UserDoesNotHaveAccessToVault = 6647
• OnlyRecipientCanSaveSecureAttachment = 6648
• OnlyRecipientCanReadSecureMessage = 6649
• TwoFactorNotConfigured = 6650

Samples of syslog records

Deleting an RDP entry

Jul 26 13:51:41 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry deleted - MessageType: 7, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:45 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Creating an RDP entry

Jul 26 13:51:37 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Entry created - MessageType: 5, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Server ABC, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: da3886a2-e653-4f56-8000-e55e5dc3313a, ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:51:41 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Training\Operationnels, Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: False, CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: 22a24c36-837b-4baf-8859-9497902a6de0, PamCredentialID: [ClientIP: 123.123.123.123]

Opening an RDP entry and a VPN connection

Jul 26 13:47:24 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Opened session - MessageType: 4, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:28 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: True, CloseMode: , OpenMode: 0, ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: True, RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Jul 26 13:47:21 10.3.1.4 Devolutions[Server] PersonalConnection - [5] VPN opened - MessageType: 8, MessageSubType: , UserName: DOMAIN\banderson, MachineName: COMPUTER123, ConnectionName: Windjammer23, ConnectionTypeName: RDP (Microsoft Remote Desktop), ConnectionID: 2c3c8c8e-70ed-494f-9680-3b24d7fb0b25, ConnectionHostName: , ConnectionUserName: bob, StartDateTime: 7/26/2022 1:47:25 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: Common\Linux (Windjammer23), Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: RDM, ClientVersion: 2022.2.14.0 , IsEmbedded: , RepositoryID: df6637ca-d40a-4251-aa33-0620383153e0, PamCredentialID: [ClientIP: 123.123.123.123]

Connection refused to resource

Jul 26 13:46:19 10.3.1.4 Devolutions[Server] PersonalConnection - [5] Access denied - Not allowed to view entry - MessageType: 66, MessageSubType: 6626, UserName: banderson

@windjammer.co, MachineName: 123.123.123.123, ConnectionName: , ConnectionTypeName: , ConnectionID: , ConnectionHostName: , ConnectionUserName: , StartDateTime: 7/26/2022 1:46:19 PM, StartDateTimeUTC: , EndDateTime: , EndDateTimeUTC: , GroupName: , Comment: , LoggedUserName: banderson

@windjammer.co, Prompt: , TickerNumber: , SecurityGroup: , Cost: , UserInfoID: 04b48fd6-3490-4457-874d-d919a0518cf4, SupportClose: , CloseMode: , OpenMode: , ClientApplication: Web, ClientVersion: 2022.2.6.0 , IsEmbedded: , RepositoryID: , PamCredentialID: [ClientIP: 123.123.123.123]