1. IgniteTech Global Support
  2. Verdiem Customer Support
  3. Event log messages Articles

List of Event Types by Category

Overview

This article lists the event types that can occur under the categories indicated in the Administrator Console.

When you view the Event Summary Report, specific events are grouped under different categories. This article lists every event type that can occur under each event category.

These are the categories described in this article:

 

Environment

Surveyor 6

 

Information

When you view data logged from system or user activity, one of the ways to filter that data is to select a specific event category. When you do this, the view is broken down by event types for the selected category. Event types represent the specific actions or errors that occurred, such as a power-state transition to sleep or wake, a user action that delayed a power-state change, and so on.

The client's log can be found in the C:\Program Files\Verdiem\Surveyor Agent\Logs folder.

Admin Actions Event Category

This category includes all manual transitions to low-power states that an administrator sets on devices.

Event types  Description Normal event?
Sleep by Admin Indicates the Administrator API call to the client operating system's API for sleep (from the menu in the Administrator Console). Yes
Hibernate by Admin  Indicates Administrator API call to the Operating Systems (OSs) API for hibernate (from the menu in the Administrator Console). Yes
Shut down by Admin  Indicates Administrator API call to the OS's API for shut
down (from the menu in the Administrator Console).		 Yes
Restart by Admin  Indicates Administrator API call to the OS's API for restart (from the menu in the Administrator Console). Yes

 

Idle Timer Actions Category

This category includes the transitions to low power states that occur specifically when the client is inactive (idle) for the length of time set in the policy assigned to it.

Event Types Description Normal event?
Sleep by Idle Timer Indicates call to the OS's API for sleep when the Surveyor idle time countdown has expired. In other words, the client agent has been inactive for the amount of time specified for the CPU in the current policy. Yes
Hibernate by Idle Timer Indicates call to the OS's API for hibernating when the Surveyor idle time countdown has expired. In other words, the client agent the CPU in the current policy. Yes

Other events recorded in this category include the initial power scheme value when the client service is started, when a power scheme is set according to the policy schedule, when the scheme is set by the user (because the scheme is created to allow the user to override it), etc.

 

Policy Actions Category

This category includes events that occur through the Power State Transition Manager (PSTM) rules and other events that occur when policies set schemes and change power states.

 Event Types Description Normal event? 
Application Protected The PSTM vetoed a state change because a protected application was running. Yes
Script Vetoed  A PSTM script vetoed a state change. Yes
Application Detected  An application of interest was detected by way of PSTM rules. Yes
Application Terminated  The PSTM terminated the indicated application. Yes
Scheme Initial Value  The initial value for the power scheme when the client service was started. Yes
Scheme Set by Policy  A switch to the power scheme enforced by the current policy when a scheduled event in the policy fires. Yes
User Scheme Restored  Restored the user's preferred scheme because the currently scheduled policy allows for it. Yes
User Scheme Restored after Service Stop  Restored the user's preferred scheme because the Surveyor client service was stopped. Yes

 

Scheduled Actions Category

This category includes any power-state change that occurs according to the schedule set in the policy assigned to the client.

 Event types Description Normal event? 
 Sleep by Policy The OS's API for sleep was called because a scheduled policy change occurred. Yes
Hibernate by Policy  The OS's API for hibernating was called because a scheduled policy change occurred. Yes
Shut Down by Policy  The OS's API for shut down was called because a scheduled policy change occurred. Yes
Restart by Policy  The OS's API for the restart was called because a scheduled policy change occurred. Yes
Wake by Policy  Indicates a scheduled policy has triggered a wake event (always appears in conjunction with 104-Power Wake) Yes

 

Service Events Category

This category includes events logged by the client service, e.g., start, stop, or device check-in. Events also include new database creation, and if data collection stops or starts for power state changes and user activity.

 Event Types Description Normal event? 
Service Started The client service was started. CPU on is assumed; all other states are unknown. Yes
Service Stopped The client service was stopped. All states should be considered unknown unless the subtype is Shutdown (CPU off). No
Power State Collection Started Indicates the start of data collection for power state transitions. CPU on can be assumed; all other power states are unknown. Yes
Power State Collection Stopped Indicates data collection stop for power state transitions; all power states go unknown. No
User Activity Collection Started Indicates the start of data collection of user actions. Power states for all users go unknown. Yes
User Activity Collection Stopped Indicates the stop of data collection for user actions; power states for all users go unknown. No
Database Created Always the first event in a new database. Yes
High Sequence Number Changed Indicates that the client updated its high sequence number to accommodate a detected re-imaging. Yes
Device Check-in Client agent checks with the server for latest instructions (as set on the Server Settings page of Administrator console). Yes

 

State Changes Category

This category includes detailed power state change data and the request source (Surveyor server, a third party, or an unknown trigger). It also includes display-only logs for power-state changes.

Event Types Description Normal event?
On State The current CPU state is on. This event is generated at any time the power state collection is initiated (through service start or a policy change). Yes
Shutdown State Surveyor received a notification from Windows that the CPU will turn off soon (the user has received notification and allowed the shutdown). Yes
Sleep State Surveyor received a notification from Windows that the CPU will transition to the sleep state soon (the user has received notification and allowed the transition). Yes
Wake State Surveyor client device wakes from a low power state (sleep or hibernate). Yes
Unknown State This event is generated at any time that power state collection is stopped (for example, if the client agent is uninstalled). No
Sleep by Third-party Indicates that a third-party, such as Cisco EnergyWise, called the OS sleep API. Yes
Hibernate by Third-party Indicates that a third-party called the OS hibernate API. Yes
Shut Down by Third-party Indicates that a third-party called the OS shut down API. Yes
Restart by Third-party Indicates that a third-party called the OS restart API. Yes
Sleep by Unknown Indicates that an unknown source has called the OS sleep API. No
Hibernate by Unknown Indicates that an unknown source has called the OS hibernate API. No
Shut Down by Unknown Indicates that an unknown source has called the OS shut down API. No
Restart by Unknown Indicates that an unknown source has called the OS restart API. No
Wake by Unknown Indicates that an unknown source has called the OS wake API. No
Display On Displays in an 'on' state. The power state (D-value) for each display is held. Yes
Display Sleep No displays in  'on' state, but at least one is in a sleep state. Yes
Display Unknown The display state is unknown. This can indicate either that power state collection stopped or failure of the detection APIs. No

 

User Actions Category

This category includes events that are logged when users take actions on power schemes or power-state change notifications when you make these actions available to them through the policy configuration. For example, you can allow users to skip or delay a power-state change or to change the power scheme in the Windows Control Panel.

 Event Types Description Normal event? 
Scheme Changed by User The end user or a third-party application changed the power scheme through the Windows Control Panel. Yes
Scheme Changed (No Policy) The end user or a third-party application switched off the enforced policy. Yes
State Change Skipped The end user chose to cancel a power state change when a notification message appears on their screen. Yes
State Change Delayed The end user chose to delay a power state change when a notification message appears on their screen. Yes

 

User Activity Category

This category includes events that indicate whether if a user is active or not, whether if a transition to a low power state based on idle time is pending or not, and if user activity is unknown (in which case, the data and activity collection may have stopped, which will be indicated by an event in the Service Events category).

 Event Types Description Normal event?
User Active Mouse or keyboard activity indicates that the user is active on a client computer. Yes
User Activity Unknown  The state of user activity is unknown. This can indicate that the data collection has stopped or detection APIs have failed. No
User Idle Mouse or keyboard activity indicates that the user is not active on a client computer. Yes 
User Idle Pending Mouse or keyboard activity indicates that the user is not active on a client computer, and a transition to a low power state is pending. Yes

 

Configuration Errors Category

Errors setting, querying, or deleting a power scheme; changing wake settings on a mouse, keyboard (including USB devices); or loading, parsing, or saving .config files.

Event Types Description Normal event?
Scheme Set API Failure An error occurred setting the power scheme in the operating system. No
Scheme Get API Failure An error occurred while querying the power scheme in the OS. No
Scheme Delete API Failure An error occurred while deleting the power scheme in the OS. No
Wake Mouse Failure Mouse movement failed to wake the client. No
Wake Keyboard Failure Keyboard use failed to wake the client. No
Wake USB Failure Use of the USB device (mouse, keyboard) failed to wake the client. (Registry setting is required on Windows XP) No
Wake Network Failure The client did not wake because of failed network card settings. No
Logging Config Failure Failed to update the logging configuration. No
Server Config Load Failure Failed to load the Surveyor server config file. No
Server Config Parse Failure Failed to parse the Surveyor server config file. No
Server Config Save Failure Failed to save the Surveyor server config file. No
EnergyWise Config Load Failure Failed to load the EnergyWise proxy server config file (applies only to environments where the client is configured for an EnergyWise domain). No
EnergyWise Config Parse Failure Failed to parse the EnergyWise proxy server config file (applies only to environments where the client is configured for an EnergyWise domain). No
EnergyWise Config Save Failure Failed to save the EnergyWise proxy server config file (applies only to environments where the client is configured for an EnergyWise domain). No

 

Policy Errors Category

This category includes errors that prevent a PSTM rule from running. For example, PSTM fails to veto a power state change, terminate an application, or report that an application has terminated.

Event Types Description Normal event? 
Script Failure A PSTM script threw an exception.  No

Check Condition Failure

 There was an error while checking for a PSTM condition. No
Veto Failure There was an error when the PSTM attempted to veto a state change as specified in a PSTM rule. No
Application Terminate Failure There was an error when the PSTM attempted to terminate an application as specified in a PSTM rule. No
Application Detect Failure There was an error when the PSTM attempted to report that an application was running. No
Idle Timer Block Failure There was an error when the PSTM attempted to block the idle timer (when PSTM rule specifies to stop transition if a particular application is running). No

 

Service Errors Category

This category includes errors that cause the client service to stop running properly. For example, the client computer loses power abnormally; the service fails to parse or run a request from the power management service; the performance counter for the idle timer is missing or failed; errors that occur while querying the user or display state.

 Event Types Description Normal event?
Service Crash The client service terminated unexpectedly. This is detected the next time the service starts. No
Abnormal Power Off The client computer was turned off abnormally. For example, a power outage or computer was unplugged. This is detected the next time the service starts. No
Resume Power Failed The client machine lost power after going into suspend. (Also detected at service start.) No
Usage Query Failure An error occurred while querying the state of user activity. No
Display Query Failure An error occurred while querying the state of display activity. No
Scheduler Failure  An error occurred in the scheduler module. No
PMP Message Parse Failure Failed to parse a PMP (power management protocol service) message, such as a power state transition request. No
PMP Message Dispatch Failure Failed to execute a PMP (power management protocol) message, such as a power state transition request. No
Device Query Failure Failed while executing a device query. For example, to get a list of network adapters. No
Performance Counter Missing A performance counter that is used with the Surveyor idle timer is missing. No
Performance Counter Failure A performance counter that is used with the Surveyor idle timer failed. No

 

Transition Errors Category

This category includes problems that occur when the API for a power state transition is called but returns a failure code. It also includes errors occurring while processing a power state transition, failure to dispatch a Wake on LAN magic packet, unexpected errors while trying to prevent narcolepsy (computer transitions to sleep while in use), etc.

Event Types Description  Normal event? 
Sleep Failure The sleep API was called, but it returned a failure code. No
Shutdown Failure The shutdown API was called, but it returned a failure code. No
Hibernate Failure The hibernate API was called, but it returned a failure code. No
Sleep General Failure An unexpected error occurred while processing a sleep request. No
Shut Down General Failure An unexpected error occurred while processing a shutdown request. No
Hibernate General Failure An unexpected error occurred while processing a hibernate request. No
Wake on WAN Dispatch Failure Failed to dispatch the Wake on WAN magic packet (UDP broadcast). No
Narcolepsy Prevention Failure There was an unexpected error while trying to prevent narcolepsy (a condition in which the client transitions to a sleep state while still considered active). No

 

EnergyWise Power Level Category

This category includes events that occur in the setting or operation of any of the eleven EnergyWise power levels.

Event Types Description Normal event?
Set to Level 0 [1, 2, 3,...,10] The client's EnergyWise level was set to zero [or to 1, 2, 3,..., 10] through the Administrator Console. Yes


If you want to make the event report view more granular, you can combine the event category filter with any combination of the other standard filters available for searching. 

How Much Data Is Retained

The historical period for which you can report events depends on a variety of system factors. These include the number of devices being managed, the reporting interval, the database server hardware, etc.

These factors determine the rate at which events are generated and the speed at which the database can process large numbers of events. Under reasonable circumstances, you should be able to view events for 2–7 months in the past. However, you might need to trim the data sooner to achieve acceptable performance. The Surveyor database contains a table for all events, along with a separate table for PC power state and user activity events. The latter events are retained for a longer period than error events. Error events are generally used for troubleshooting and resolved relatively shortly after a problem occurs.

Comments

0 comments

Article is closed for comments.

Was this article helpful?
0 out of 0 found this helpful
Related Articles
Recent Articles

Related articles