Events are records of administrative and device actions that the Workspace ONE UEM console stores in logs. Export event logs as CSV files. You can also configure the Workspace ONE UEM console to send the event logs to your Security Information and Event Management tools or Business Intelligence systems.

The event logs show both device events and Workspace ONE UEM console events. Device events show the commands sent from the console to devices, device responses, and device user actions. Console events show actions taken from the Workspace ONE UEM console including login sessions, failed login attempts, admin actions, system settings changes, and user preferences.

You can filter the date range, severity level, category, or module.

Severity levels include the following descriptions.

  • Critical – Indicates a failure in a primary Workspace ONE UEM console system.
  • Error – Indicates a failure in a non-primary Workspace ONE UEM console system.
  • Warning – Indicates an issue in the future if action is not taken.
  • Notice – Indicates unusual conditions.
  • Information – Indicates normal operational data.
  • Debug – Indicates useful information for troubleshooting.
Note:

If your selected Date Range option returns more than 10,000 events , then a banner message displays recommending that you select a smaller date range. If you prefer a larger date range, then run an event report for each multiple child OG rather than a single event report on a single parent OG.

Console Events

Console events show MDM actions from the Workspace ONE UEM console that include the following examples: Login sessions, Failed login attempts, Admin actions, System settings changes, and User preferences.

  1. Navigate to Monitor > Reports and Analytics > Events > Console Events.
  2. Filter the information to focus and narrow the list of devices.
    Choose from:
    • Date Range (see Note above)
    • Severity
    • Category
    • Module
  3. Click the Event Data option to view information for a specific console event.

Device Events

Device events is a listing of several different kinds of events logged by the system. It lists Mobile Device Management (MDM) commands to devices, device responses, and device user actions. You can filter the log by date range, the severity level, category, or module.

Severity levels for device events include the following descriptions.

  • Emergency – Indicates a catastrophic MDM failure requiring immediate attention.
  • Alert – Indicates a failure of a foundational MDM system requiring attention.
  • Critical – Indicates a failure in a primary MDM system.
  • Error – Indicates a failure in a non-primary MDM system.
  • Warning – Indicates an issue in the future if action is not taken.
  • Notice – Indicates unusual conditions.
  • Information – Indicates normal operational data.
  • Debug – Indicates useful information for troubleshooting.

Take the following steps to examine device event logs.

  1. Navigate to Monitor > Reports and Analytics > Events > Device Events.
  2. Filter the information to focus and narrow the list of devices.

    Choose from:

    • Date Range (see Note above)
    • Severity
    • Category
    • Module
  3. Select the Friendly Name option to view data about a specific device.
  4. Select the User option to perform various functions, including Add Device, Edit options, and Change Organization Group.

Change Syslog Settings

You can make Syslog setting changes. Navigate to the settings page at Groups & Settings > All Settings > System > Enterprise Integration > Syslog.

Alternatively, you can select the Syslog menu item located below the Device Events menu item at Monitor > Reports and Analytics > Events > Syslog.

For more information, see Syslog Integration.

Change Event Settings

You can change the minimum logging level for Console and Device events. Navigate to Groups & settings > All Settings > Admin > Events and select the Event Settings button.

Set the minimum log level for Device and Console events. Events that meet the selected levels and above for both Device and Console are captured and stored by the Workspace ONE UEM database and displayed in the Workspace ONE UEM console on the Monitor > Reports & Analytics > Events > Device Events and Console Events pages.