Events are records of administrative and device actions that the AirWatch Console stores in logs. Export event logs as CSV files. You can also configure the AirWatch Console to send the event logs to your Security Information and Event Management tools or Business Intelligence systems.

The event logs show both device events and AirWatch Console events. Device events show the commands sent from the AirWatch Console to devices, device responses, and device user actions. The AirWatch Console events show actions taken from the AirWatch Console including login sessions, failed login attempts, admin actions, system settings changes, and user preferences.

You can filter the severity level, category, or module. Severity levels include:

  • Critical – Indicates a failure in a primary AirWatch Console system.
  • Error – Indicates a failure in a non-primary AirWatch Console system.
  • Warning – Indicates a possible issue in the future.
  • Notice – Indicates unusual conditions.
  • Information – Indicates normal operational data.
  • Debug – Indicates useful information for troubleshooting.