Events are records of administrative and device actions that the Workspace ONE UEM console stores in logs. Export event logs as CSV files. You can also configure the Workspace ONE UEM console to send the event logs to your Security Information and Event Management tools or Business Intelligence systems.
The event logs show both device events and Workspace ONE UEM console events. Device events show the commands sent from the console to devices, device responses, and device user actions. Console events show actions taken from the Workspace ONE UEM console including login sessions, failed login attempts, admin actions, system settings changes, and user preferences.
You can filter the date range, severity level, category, or module.
Severity levels include the following descriptions.
Note: If the Date & Time option returns more than 10,000 events, then a banner message displays recommending that you select a smaller date range. If you prefer a larger date range, then run an event report for each multiple child OG rather than a single event report on a single parent OG.
Console events show MDM actions from the Workspace ONE UEM console that include the following examples: Login sessions, Failed login attempts, Admin actions, System settings changes, and User preferences.
Apply a filter () to the list of console events.
Device events are a listing of several different kinds of events logged by the system. It lists Mobile Device Management (MDM) commands to devices, device responses, and device user actions. You can filter the log by date range, the severity level, category, or module.
Severity levels for device events include the following descriptions.
Examine device event logs by taking the following steps.
Apply a filter () to the list of device events.
You can make Syslog setting changes. Navigate to the settings page at Groups & Settings > All Settings > System > Enterprise Integration > Syslog.
Alternatively, you can select the Syslog menu item at Monitor > Reports and Analytics > Events > Syslog.
For more information, see Syslog Integration.
You can change the minimum logging level for events. Navigate to Groups & settings > All Settings > Admin > Events and select the Event Settings button.
Set the minimum log level for Device and Console events. Events that meet the selected levels and above for both Device and Console are captured and stored by the Workspace ONE UEM database and displayed in the Workspace ONE UEM console on the Monitor > Reports & Analytics > Events > Device Events and Console Events pages.