Syslog events
Each syslog message contains the name of the event that triggered the message to be logged. While a number of syslog events are defined by the BeyondTrust Appliance B Series, most of the event types are defined within the /login administrative interface and are triggered by actions such as login attempts, user creation, and so forth. The representative console also triggers syslog messages, but only for login and logout attempts.
Below is a comprehensive list of the possible events included with this version of BeyondTrust software, accompanied by a brief description of each event.
Note
Some events may be caused by multiple triggers. In those cases, the triggers are identified below.
| Event | Trigger |
|---|---|
| account_group_added | A new account group has been added and saved. |
| account_group_changed | An existing account group has been modified and saved. |
| account_group_removed | An existing account group has been deleted. |
| account_added | A new account has been added and saved. |
| account_changed | An existing account has been modified and saved. |
| account_removed | An existing account has been deleted. |
| account_jump_item_association_added | An association with a Jump Item was added for the account. |
| account_jump_item_association_changed | An association with a Jump Item was changed for the account. |
| account_jump_item_direct_association_added | The account is allowed to be injected for the specific Jump Items. |
| account_jump_item_direct_association_removed | The account is removed from the allowed list to be injected for the specific Jump Items. |
| accounts_changed | A group of one or more accounts was modified. |
| access_sponsor_group_added | A new access sponsor group has been defined and saved. |
| access_sponsor_group_changed | An existing access sponsor group’s name or description has been changed, and the change has been saved. |
| access_sponsor_group_member_added | A new member has been added to an access sponsor group, and the group has been saved. |
| access_sponsor_group_member_changed | An existing member has been assigned to a different role in an access sponsor group, and the group has been saved. |
| access_sponsor_group_member_removed | An existing member has been deleted from an access sponsor group, and the group has been saved. |
| access_sponsor_group_removed | An existing access sponsor group has been deleted. |
| admin_password_reset_to_factory_default | The Reset Admin Account button has been clicked, reverting a site’s administrative account to its default credentials. |
| api_account_added | A new API account has been added and saved. |
| api_account_changed | An existing API account has been modified and saved. |
| api_account_removed | An existing API account has been deleted. |
| backup_created | A backup of the current software configuration has been saved. |
| canned_message_added | A new canned message has been added and saved. |
| canned_message_category_added | A new canned message category has been added and saved. |
| canned_message_cateogry_changed | An existing canned message category has been modified and saved. |
| canned_message_category_removed | An existing canned message category has been deleted. |
| canned_message_changed | An existing canned message has been modified and saved. |
| canned_message_removed | An existing canned message has been deleted. |
| canned_message_team_added | A canned message has been newly assigned to a team, and the message has been saved. |
| canned_message_team_changed | A canned message has been edited, and this team has neither been added nor removed. |
| canned_message_team_removed | A previously assigned canned message has been unassigned from a team, and the message has been saved. |
| canned_script_added | A new canned script has been added and saved. |
| canned_script_category_added | A canned script has been newly assigned to a category, and the script has been saved. |
| canned_script_category_removed | A previously assigned canned message has been unassigned from a category, and the script has been saved. |
| canned_script_changed | An existing canned script’s name, description, or command sequence has been changed, and the change has been saved. |
| canned_script_file_added | A resource file has been newly associated with a canned script, and the script has been saved. |
| canned_script_file_removed | A previously associated resource file has been removed from a canned script, and the script has been saved. |
| canned_script_removed | An existing canned script has been deleted. |
| canned_script_team_added | A support team has been newly assigned to a canned script, and the script has been saved. |
| canned_script_team_removed | A previously assigned support team has been unassigned from a canned script, and the script has been saved. |
| canned_scripts_category_added | A new canned scripts category has been created. |
| canned_scripts_category_removed | An existing canned scripts category has been deleted. |
| canned_scripts_file_added | A new canned script resource file has been uploaded. |
| canned_scripts_file_removed | An existing canned script resource file has been deleted. |
| certificate_export | An SSL certificate has been exported from the BeyondTrust Appliance B Series. |
| change_display_name | A user has attempted to change their display name. |
| change_password | A user has attempted to change their password. |
| change_username | A user has attempted to change their username. |
| cust_exit_survey_question_added | A new customer exit survey question has been added and saved. |
| cust_exit_survey_question_changed | An existing customer exit survey question has been edited and saved. |
| cust_exit_survey_question_option_added | A new option, such as a radio button, check box, or menu item, has been added to a customer exit survey question, and the question has been saved. |
| cust_exit_survey_question_option_changed | An existing option for a customer exit survey question, such as a radio button, check box, or menu item, has been edited, and the question has been saved. |
| cust_exit_survey_question_option_removed | An existing option for a customer exit survey question, such as a radio button, check box, or menu item, has been removed, and the question has been saved. |
| cust_exit_survey_question_removed | An existing customer exit survey question has been deleted. |
| custom_rep_link_added | A new custom link has been added and saved. |
| custom_rep_link_changed | An existing custom link has been edited and saved. |
| custom_rep_link_removed | An existing custom link has been deleted. |
| custom_session_attribute_added | A new custom field for API integration has been added and saved. |
| custom_session_attribute_changed | An existing custom field for API integration has been edited and saved. |
| custom_session_attribute_removed | An existing custom field for API integration has been removed. |
| custom_session_policy_added | Custom session permissions have been added to a user account, and the user account has been saved. |
| custom_session_policy_changed | Existing custom session permissions have been edited, and the user account has been saved. |
| custom_session_policy_removed | Existing custom session permissions have been removed from a user account, and the user account has been saved. |
| custom_special_action_added | A new custom special action has been added and saved. |
| custom_special_action_changed | An existing custom special action has been edited and saved. |
| custom_special_action_removed | An existing custom special action has been removed. |
| customer_notice_added | A new customer notice has been added and saved. |
| customer_notice_changed | An existing customer notice has been edited and saved. |
| customer_notice_public_site_added | A customer notice has been enabled for a public site, and the customer notice has been saved. |
| customer_notice_public_site_removed | A customer notice has been disabled for a public site, and the customer notice has been saved. |
| customer_notice_removed | An existing customer notice has been removed. |
| customizable_text_changed | An existing customer greeting, on-hold message, or login agreement has been changed. |
| default_site_changed | The default support site for this B Series Appliance has been changed to another site, and the change has been saved. |
| discovery_error_added | A new Discovery job error has been added. |
| discovery_error_changed | A new Discovery job error has been changed. |
| discovery_error_removed | A new Discovery job error has been removed. |
| domain_added | A new Vault domain has been added and saved. |
| domain_changed | An existing Vault domain has been modified and saved. |
| domain_removed | An existing Vault domain has been deleted. |
| downloaded_rep_client | A user has clicked the link to download the representative console. |
| endpoint_automation_resource_added | A new endpoint automation resource was uploaded. |
| endpoint_automation_resource_changed | An endpoint automation resource has been replaced. |
| endpoint_automation_resource_removed | A endpoint automation resource was deleted. |
| endpoint_changed | An existing endpoint has been modified and saved. |
| endpoint_removed | An existing endpoint has been deleted. |
| eula_accepted | The BeyondTrust Cloud end-user license agreement (EULA) has been accepted by a user, and the username has been recorded. |
| fido2_credential_added | A new FIDO2 Autheticator has been added and saved. |
| fido2_credential_changed | An existing FIDO2 Autheticator has been modified and saved. |
| fido2_credential_removed | An existing FIDO2 Autheticator has been deleted. |
| file_removed_from_file_store | A file has been deleted from the file store. |
| file_uploaded_to_file_store | A file has been added to the file store. |
| group_policy_added | A new group policy has been created and saved. |
| group_policy_changed | An existing group policy’s priority level has changed, and the change has been saved. |
| group_policy_member_added | A new member has been added to a group policy, and the policy has been saved. |
| group_policy_member_removed | An existing member has been removed from a group policy, and the policy has been saved. |
| group_policy_removed | An existing group policy has been deleted. |
| group_policy_setting_added | A group policy setting has been designated as defined in this policy, and the policy has been saved. |
| group_policy_setting_changed | An existing group policy setting or override status has been changed, and the policy has been saved. |
| group_policy_setting_removed | A group policy setting previously defined in this policy has been removed, and the policy has been saved. |
| ios_content_item_added | A new iOS configuration profile has been created and saved. |
| ios_content_item_changed | An existing iOS configuration profile has had a new file uploaded or has had its public availability changed, and the profile has been saved. |
| ios_content_item_removed | An existing iOS configuration profile has been deleted. |
| jump_item_role_added | A new Jump Item Role has been created and saved. |
| jump_item_role_changed | An existing Jump Item Role has been modified and saved. |
| jump_item_role_removed | An existing Jump Item Role has been deleted. |
| jump_policy:schedule_entry_added | A new schedule entry has been added to a Jump Policy, and the policy has been saved. |
| jump_policy:schedule_entry_removed | An existing schedule entry has been removed from a Jump Policy, and the policy has been saved. |
| jump_policy_added | A new Jump Policy has been created and saved. |
| jump_policy_changed | An existing Jump Policy has been modified and saved. |
| jump_policy_removed | An existing Jump Policy has been deleted. |
| jumpoint_cluster_added | A new Jumpoint or Jumpoint cluster has been created and saved. |
| jumpoint_cluster_changed | An existing Jumpoint or Jumpoint cluster has been changed. |
| jumpoint_cluster_removed | An existing Jumpoint or Jumpoint cluster has been deleted. |
| jumpoint_user_added | A new member has been added to a Jumpoint, and the Jumpoint has been saved. |
| jumpoint_user_removed | An existing member has been removed from a Jumpoint, and the Jumpoint has been saved. |
| kerberos_keytab_added | A new Kerberos keytab has been uploaded. |
| kerberos_keytab_removed | An existing Kerberos keytab has been deleted. |
| license_pool_added | A new license pool has been created and saved. |
| license_pool_changed | An existing license pool has been changed, and the license pool has been saved. |
| license_pool_removed | An existing license pool has been deleted. |
| license_usage_report_generated | A report of peak license usage has been run. |
| login | A login attempt has been made. |
| login_schedule_entry_added | A new login schedule entry has been added to a user's, or group policy's login schedule, and the user account or group policy has been saved. |
| login_schedule_entry_removed | An existing login schedule entry has been removed from a user's, or group policy's login schedule, and the user or group policy has been saved. |
| logout | A user has logged out of the representative console, whether by deliberate action, by an administrator, or as the result of a lost connection to the BeyondTrust Appliance B Series. |
| management_account_added | A new management account has been added and saved. |
| management_account_changed | An existing management account has been modified and saved. |
| management_account_removed | An existing management account has been deleted. |
| msgraph_http_recipient_added | A new service principal has been added and saved. |
| msgraph_http_recipient_changed | An existing service principal has been modified and saved. |
| msgraph_http_recipient_removed | An existing service principal has been deleted. |
| network_address_added | A new IP address has been added and saved. |
| network_address_changed | An existing IP address has been modified and saved. |
| network_address_removed | An existing IP address has been deleted You cannot delete the default route. |
| network_changed | The global network configuration has been changed, and the change has been saved. |
| network_route_changed | A static route has been added, modified, or removed. |
| network_tunnel_jump_item_added | A network tunnel Jump Item has been added. |
| network_tunnel_jump_item_changed | A network tunnel Jump Item has been changed and saved. |
| network_tunnel_jump_item_removed | A network tunnel Jump Item has been removed. |
| outbound_event_email_recipient_added | A new email outbound event has been added and saved. |
| outbound_event_email_recipient_changed | An existing email outbound event has been modified and saved. |
| outbound_event_email_recipient_removed | An existing email outbound event has been deleted. |
| outbound_event_email_trigger_added | A new trigger has been added for an email outbound event, and the event has been saved. |
| outbound_event_email_trigger_removed | An existing trigger for an email outbound event has been removed, and the event has been saved. |
| outbound_event_http_recipient_added | A new HTTP outbound event has been added and saved. |
| outbound_event_http_recipient_changed | An existing HTTP outbound event has been modified and saved. |
| outbound_event_http_recipient_removed | An existing HTTP outbound event has been deleted. |
| outbound_event_http_trigger_added | A new trigger has been added for an HTTP outbound event, and the event has been saved. |
| outbound_event_http_trigger_removed | An existing trigger for an HTTP outbound event has been removed, and the event has been saved. |
| pdcust_banner_reverted_to_factory_default | The banner image for the presentation attendee client has been reverted to the default image. |
| pdcust_banner_uploaded | A new banner image for the presentation attendee client has been uploaded to the site. |
| presentation_session_detail_generated | A detailed report has been run for a presentation session. |
| presentation_session_report_generated | A report of presentation sessions has been run. |
| public_site_added | A new public site has been created and saved. |
| public_site_address_added | A hostname has been added to a public site, and the site has been saved. |
| public_site_address_removed | A hostname has been removed from a public site, and the site has been saved. |
| public_site_changed | An existing public site has been changed. |
| public_site_customer_banner_reverted_to_factory_default | The banner image for the customer client has been reverted to the default image. |
| public_site_customer_banner_uploaded | A new banner image for the customer client has been uploaded to the site. |
| public_site_exit_survey_added | A question has been added to a public site’s customer or representative survey, and the site has been saved. |
| public_site_exit_survey_removed | A question has been removed from a public site’s customer or representative survey, and the site has been saved. |
| public_site_removed | An existing public site has been deleted. |
| public_site_session_attribute_added | A public site session attribute has been added. |
| public_site_session_attribute_changed | A public site session attribute has been changed. |
| public_site_session_attribute_removed | A public site session attribute has been removed. |
| public_site_setting_added | A public site setting has been defined for the first time, and the site has been saved. |
| public_site_setting_changed | A public site setting has been modified, and the site has been saved. |
| public_site_team_added | A support team’s issues have been added to a public site’s front-end survey, and the site has been saved. |
| public_site_team_removed | A support team’s issues have been removed from a public site’s front-end survey, and the site has been saved. |
| public_site_template_asset_uploaded | A new HTML asset file has been uploaded to the site. |
| public_site_template_asset_reverted | An HTML template asset file has been reverted to the default. |
| public_template_deleted | An HTML template has been removed. |
| public_template_written | An HTML template has been modified and saved. |
| reboot | The BeyondTrust Appliance B Series has been rebooted. |
| remote_rfb_jump_item_added | A Remote RFB Jump Item has been added. |
| remote_rfb_jump_item_removed | A Remote RFB Jump Item has been removed. |
| rep_client_connection_terminated | An administrator has terminated a representative’s connection. |
| rep_console_setting_added | A managed representative console setting has been defined for the first time, and the settings have been saved. |
| rep_console_setting_changed | A managed representative console setting has been changed, and the settings have been saved. |
| rep_console_setting_removed | A managed representative console setting has been marked as undefined, and the settings have been saved. |
| rep_exit_survey_question_added | A new representative survey question has been added and saved. |
| rep_exit_survey_question_changed | A representative survey question has been edited and saved. |
| rep_exit_survey_question_option_added | A new option, such as a radio button, check box, or menu item, has been added to a representative survey question, and the question has been saved. |
| rep_exit_survey_question_option_changed | An existing option for a representative survey question, such as a radio button, check box, or menu item, has been edited, and the question has been saved. |
| rep_exit_survey_question_option_removed | An existing option, such as a radio button, check box, or menu item, has been removed from a representative survey question, and the question has been saved. |
| rep_exit_survey_question_removed | An existing representative survey question has been deleted. |
| rep_invite_added | A session policy has been made available for rep invites, and the session policy has been saved. |
| rep_invite_removed | A session policy has been made unavailable for rep invites and has been saved, or a session policy available for rep invites has been deleted. |
| repinvite_setting_added | A rep invite setting has been added because a session policy has been made available for rep invites, and the session policy has been saved. |
| repinvite_setting_removed | A rep invite setting has been removed either because a session policy has been made unavailable for rep invites and has been saved, or because a session policy available for rep invites has been deleted. |
| reporting_erasure | Session reports have had representative or customer data anonymized. |
| restored_from_backup | The software configuration has been successfully restored from its backup file. |
| restoring_from_backup | The software configuration is in the process of restoring from its backup file. |
| scheduled_discovery_job_added | The domain scheduled discovery has been added. |
| scheduled_discovery_job_changed | The domain scheduled discovery has been changed. |
| sdcust_exit_survey_report_generated | A report of customer exit survey results has been run. |
| sdrep_exit_survey_report_generated | A report of representative survey results has been run. |
| security_provider_added | A new security provider configuration has been added and saved. |
| security_provider_changed | An existing security provider configuration’s priority level has changed, and the change has been saved. |
| security_provider_removed | An existing security provider configuration has been deleted. |
| security_provider_setting_added | A security provider setting has been added as part of the initial configuration, and the configuration has been saved. |
| security_provider_setting_changed | An existing security provider configuration has been modified and saved. |
| security_provider_setting_removed | A security provider setting has been removed as part of the deletion of a security provider configuration. |
| session_policy_added | A new session policy has been added and saved. |
| session_policy_changed | An existing session policy has been modified and saved. |
| session_policy_removed | An existing session policy has been deleted. |
| server_software_restarted | The BeyondTrust software has been restarted. |
| setting_added | A setting has been defined and saved for the first time. |
| setting_changed | A setting has been modified and saved. |
| skill_added | A new skill has been added and saved. |
| skill_changed | An existing skill has been modified and saved. |
| skill_removed | An existing skill has been deleted. |
| SNMP_changed | The SNMPv2 Server has been changed. |
| ssh_account_added | An SSH account has been added. |
| ssh_account_changed | An SSH account has been modified and saved. |
| ssh_account_removed | An SSH account has been removed. |
| starting_support_tunnel | A support tunnel has been initiated from the BeyondTrust Appliance B Series. |
| support_button_profile_added | A new Support Button profile has been added and saved. |
| support_button_profile_changed | An existing Support Button profile has been changed and saved. |
| support_button_profile_icon_uploaded | A new icon has been uploaded to a Support Button profile. |
| support_button_profile_removed | An existing Support Button profile has been deleted. |
| support_issue_added | A new support issue has been added and saved. |
| support_issue_changed | An existing support issue has been modified and saved. |
| support_issue_removed | An existing support issue has been deleted. |
| support_issue_skill_added | A new skill has been assigned to a support issue, and the issue has been saved. |
| support_issue_skill_removed | An existing skill has been removed from a support issue, and the issue has been saved. |
| support_session_detail_generated | A detailed report has been run for a support session. |
| support_session_report_generated | A report of support sessions has been run. |
| support_session_summary_report_generated | A summary report of support sessions has been run. |
| support_team_added | A support team has been added. |
| support_team_changed | A support team has been changed. |
| support_team_jump_access_added | A team has been granted access to another team's Jump Clients, and the change has been saved. |
| support_team_jump_access_removed | A team's access to another team's Jump Clients has been removed, and the change has been saved. |
| support_team_member_added | A new member has been added to a team, and the team has been saved. |
| support_team_member_changed | An existing member has been assigned a different role in a team, and the team has been saved. |
| support_team_member_removed | An existing member has been deleted from a team, and the team has been saved. |
| support_team_removed | An existing support team has been deleted. |
| syslog_server_changed | The remote syslog server setting has been changed and saved. |
| team_activity_report_generated | A team activity report has been run. |
| user_account_report_generated | A user account report has been generated. |
| user_added | A new local user has been created and saved. Event fields differ between /login users and /appliance users. |
| user_changed | An existing local user has been modified and saved. Event fields differ between /login users and /appliance users. |
| user_removed | An existing local user has been deleted. Event fields differ between /login users and /appliance users. |
| user_session_policy_added | A session policy has been applied to a user account, and the user account has been saved. |
| user_session_policy_removed | A session policy has been removed from a user account, and the user account has been saved. |
| user_skill_added | A new skill has been assigned to a user, and the user account has been saved. |
| user_skill_removed | An existing skill has been removed from a user, and the user account has been saved. |
| vault_account_password_rotation | Vault account password has been rotated. |
Updated 18 days ago