Event Logs

Events are records of administrative and device actions that the Workspace ONE UEM console stores in logs. Export event logs as CSV files. You can also configure the Workspace ONE UEM console to send the event logs to your Security Information and Event Management tools or Business Intelligence systems.

The event logs show both device events and Workspace ONE UEM console events. Device events show the commands sent from the console to devices, device responses, and device user actions. Console events show actions taken from the Workspace ONE UEM console including login sessions, failed login attempts, admin actions, system settings changes, and user preferences.

You can filter the date range, severity level, category, or module.

Severity levels include the following descriptions.

• Critical – Indicates a failure in a primary Workspace ONE UEM console system.
• Error – Indicates a failure in a non-primary Workspace ONE UEM console system.
• Warning – Indicates an issue in the future if action is not taken.
• Notice – Indicates unusual conditions.
• Information – Indicates normal operational data.
• Debug – Indicates useful information for troubleshooting.

Note: If the Date & Time option returns more than 10,000 events, then a banner message displays recommending that you select a smaller date range. If you prefer a larger date range, then run an event report for each multiple child OG rather than a single event report on a single parent OG.

Console Events

Console events show MDM actions from the Workspace ONE UEM console that include the following examples: Login sessions, Failed login attempts, Admin actions, System settings changes, and User preferences.

1. Navigate to Monitor > Reports and Analytics > Events > Console Events.

2. Apply a filter () to the list of console events.

   Choose from:

   • Date & Time (see Note above)
   • Severity
   • Category
   • Module
3. View details of a specific console event by selecting the Event option.

Device Events

Device events are a listing of several different kinds of events logged by the system. It lists Mobile Device Management (MDM) commands to devices, device responses, and device user actions. You can filter the log by date range, the severity level, category, or module.

Severity levels for device events include the following descriptions.

• Emergency – Indicates a catastrophic MDM failure requiring immediate attention.
• Alert – Indicates a failure of a foundational MDM system requiring attention.
• Critical – Indicates a failure in a primary MDM system.
• Error – Indicates a failure in a non-primary MDM system.
• Warning – Indicates an issue in the future if action is not taken.
• Notice – Indicates unusual conditions.
• Information – Indicates normal operational data.
• Debug – Indicates useful information for troubleshooting.

Examine device event logs by taking the following steps.

1. Navigate to Monitor > Reports and Analytics > Events > Device Events.

2. Apply a filter () to the list of device events.

   Choose from:

   • Date & Time (see Note above)
   • Severity
   • Category
   • Module
3. View details of a specific device event by selecting the Event option.
4. View details of a specific device by selecting the Device Friendly Name option.
5. You can Add Device, Edit options, and Change Organization Group by selecting the Enrollment UserName option.

Change Syslog Settings

You can make Syslog setting changes. Navigate to the settings page at Groups & Settings > All Settings > System > Enterprise Integration > Syslog.

Alternatively, you can select the Syslog menu item at Monitor > Reports and Analytics > Events > Syslog.

For more information, see Syslog Integration.

Change Event Settings

You can change the minimum logging level for events. Navigate to Groups & settings > All Settings > Admin > Events and select the Event Settings button.

Set the minimum log level for Device and Console events. Events that meet the selected levels and above for both Device and Console are captured and stored by the Workspace ONE UEM database and displayed in the Workspace ONE UEM console on the Monitor > Reports & Analytics > Events > Device Events and Console Events pages.