Skip to main content
Skip table of contents

V 2.0 Authentication Flow Diagnostics Event

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 Authentication Flow Diagnostics EventBase RuleDiagnostic InformationInformation
V 2.0 EVID 22000: Auth Resulted In Internal ErrorSub RuleGeneral Authentication ErrorError
V 2.0 EVID 22001: Restricted Attribute(s) FoundSub RuleObject Attributes ListedInformation
V 2.0 EVID 22002: Authentication CompletedSub RuleAuthentication ActivityAuthentication Success
V 2.0 EVID 22003: Missing Attribute For AuthSub RuleAttribute MissingWarning
V 2.0 EVID 22004: Authentication Wrong PasswordSub RuleFailed Unauthorized ActivityFailed Misuse
V 2.0 EVID 22005: Could Not Get Shell Profile ObjSub RuleShell Profiles Not FoundError
V 2.0 EVID 22006: Shell Profile Object Not ConfigSub RuleShell Profile Object Not ConfiguredInformation
V 2.0 EVID 22007: Username Attribute Not PresentSub RuleAttributes Not FoundError
V 2.0 EVID 22008: Changing Enable Pwd Not AllowedSub RulePassword Change FailedError
V 2.0 EVID 22015: Identity Seq Continues To NextSub RuleContinuing Identity SequenceInformation
V 2.0 EVID 22016: Identity Seq Completed IteratingSub RuleSuccessful ActivityOther Audit Success
V 2.0 EVID 22017: Selected Identity Src DenyAccessSub RuleAccess DeniedWarning
V 2.0 EVID 22019: Identity Policy Evaluated BeforeSub RuleGeneral POLICY InformationInformation
V 2.0 EVID 22020: Config Error Identity Src BlankSub RuleIdentity Source BlankError
V 2.0 EVID 22021: Config Error Auth IDStores ListSub RuleConfiguration ErrorError
V 2.0 EVID 22022: Setting Err Failed To Open OptSub RuleGeneral Failed ActivityFailed Activity
V 2.0 EVID 22023: Proceed To Attribute RetrievalSub RuleProceed To Attribute RetrievalInformation
V 2.0 EVID 22028: Auth Failed Advanced Opt IgnoredSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22034: Attribute Retrieval FailedSub RuleAttribute Retrieval FailedError
V 2.0 EVID 22036: Retrieved Attributes SuccessfulSub RuleAttribute Retrieval SucceededInformation
V 2.0 EVID 22037: Authentication PassedSub RuleAuthentication ActivityAuthentication Success
V 2.0 EVID 22038: Skipping IDStore For Attr Retr.Sub RuleSkipping IDStore For Attribute RetrievalInformation
V 2.0 EVID 22039: Invalid Workflow Sequence TypeSub RuleInvalid Sequence TypeError
V 2.0 EVID 22040: Wrong Pwd/Invalid Shared SecretSub RuleFailed Unauthorized ActivityFailed Misuse
V 2.0 EVID 22043: Auth Method Not SupportedSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22044: Identity Policy Res Not ConfigSub RulePolicy Not ConfiguredError
V 2.0 EVID 22045: Identity Policy Res Not ConfigSub RulePolicy Not ConfiguredError
V 2.0 EVID 22046: Identity Sequence Received CARSub RuleAuthentication Request ReceivedInformation
V 2.0 EVID 22047: Username Attribute MissingSub RuleAttribute MissingWarning
V 2.0 EVID 22048: Client Cert. Binary MissingSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22049: Binary Comparison Of Cert. FailSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22050:User/Host Disable In Curr IDStoreSub RuleHost DisabledOther Audit
V 2.0 EVID 22051: User/Host Disable In Int IDStoreSub RuleHost DisabledOther Audit
V 2.0 EVID 22052: Authentication IDStore EmptySub RuleIDStore EmptyError
V 2.0 EVID 22054: Binary Comparison Of Cert. PassSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22055: Failed To Find Expected UsernameSub RuleGeneral Failed ActivityFailed Activity
V 2.0 EVID 22056: Subject Not Found In ApplicableSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22057: Used Adv Opt Config For FailedSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22058: Used Adv Opt Config For UnknownSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22059: Used Adv Opt Config For ProcessSub RuleProcess FailedError
V 2.0 EVID 22060: Continue Advanced Option ConfigSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22061: Reject Advanced Option ConfigSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22062: Drop Advanced Option ConfigSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22063: Wrong PasswordSub RuleFailed Unauthorized ActivityFailed Misuse
V 2.0 EVID 22064: Auth Method Not SupportedSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22065: Guest Session Limit Not EnforcedSub RuleSession InformationInformation
V 2.0 EVID 22066: Removing Older Guest SessionsSub RuleObject Deleted/RemovedAccess Success
V 2.0 EVID 22067: Missing Relevant InformationSub RuleSession InformationInformation
V 2.0 EVID 22068: Binary Comparison Of Cert. SkipSub RuleSession InformationInformation
V 2.0 EVID 22069: AD Account Search Attr. MissingSub RuleAttribute MissingWarning
V 2.0 EVID 22070: Identity Name Taken From Cert.Sub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22071: Identity Name Taken From AD AccSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22072: Selected Identity Source Seq.Sub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 22073: Removing Newest Guest SessionSub RuleObject Deleted/RemovedAccess Success
V 2.0 EVID 22074: Protocol Disabled In FIPS ModeSub RuleProtocol DisabledInformation
V 2.0 EVID 22080: New Accounting Session CreatedSub RuleObject CreatedAccess Success
V 2.0 EVID 22081: Max Sessions Policy PassedSub RuleGeneral POLICY InformationInformation
V 2.0 EVID 22082: Max Sessions Policy DisabledSub RuleGeneral POLICY InformationInformation
V 2.0 EVID 22083: User/Grp Session Counters Inc.Sub RuleProcess/Service StartedStartup and Shutdown
V 2.0 EVID 22084: User/Grp Session Counters Dec.Sub RuleProcess/Service StoppedStartup and Shutdown
V 2.0 EVID 22085: Accounting Session UpdatedSub RuleObject ModifiedAccess Success
V 2.0 EVID 22086: Active Session Purged For DeviceSub RuleSession InformationInformation
V 2.0 EVID 22087: Accounting Session Timed OutSub RuleSession Timed OutWarning
V 2.0 EVID 22088: Accounting Session PurgedSub RuleSession InformationInformation
V 2.0 EVID 22089: Session Limit Reached New UserSub RuleSession InformationInformation
V 2.0 EVID 22090: One Or More Attributes MissingSub RuleAttribute MissingWarning
V 2.0 EVID 22091: Excessive Failed Auth AttemptsSub RuleAuthentication Failure ActivityAuthentication Failure
V 2.0 EVID 22092: No Accounting Start ReceivedSub RuleSession InformationInformation
V 2.0 EVID 22093: Duplicate Session FoundSub RuleDuplicate EventInformation
V 2.0 EVID 22094: Audit Session Not FoundSub RuleSession InformationInformation
V 2.0 EVID 22095: Accounting Start ReceivedSub RuleSession InformationInformation
V 2.0 EVID 22096: Max Session Policy Not AvailableSub RuleSession InformationInformation
V 2.0 EVID 22097: Max Session Group Limit ReachedSub RuleSession InformationInformation
V 2.0 EVID 22098: Max Sess User In Grp Limit ReachSub RuleSession InformationInformation

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
pri_numN/AN/APriority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value.
The facility code valid options are:
LOCAL0 (Code = 16)
LOCAL1 (Code = 17)
LOCAL2 (Code = 18)
LOCAL3 (Code = 19)
LOCAL4 (Code = 20)
LOCAL5 (Code = 21)
LOCAL6 (Code = 22; default)
LOCAL7 (Code = 23)
timeN/AN/ADate of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.
IP address/hostnameN/AN/AIP address of the originating Cisco ISE node, or the hostname.
cat_name<vendorinfo>Text/StringLogging category name preceded by the CSCOxxx string.
msg_idN/AN/AUnique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.
total_segN/AN/ATotal number of segments in a log message. Long messages are divided into more than one segment.
Note: The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.
seg_numN/AN/ASegment sequence number within a message. Use this number to determine what segment of the message you are viewing.
timestampN/AN/ADate of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format: YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.
sequence_numN/AN/AGlobal counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.
msg_code<vmid>
<tag1>
NumberMessage code as defined in the logging categories.
msg_sev<severity>Text/StringMessage severity level of a log message.
msg_class<subject>Text/StringMessage class, which identifies groups of messages with the same context.
msg_text<action>Text/StringEnglish language descriptive text message.
ConfigVersionIdN/AN/AN/A
DestinationIPAddress<dip>IP AddressN/A
UserName<account>Text/StringN/A
NAS-IP-AddressN/AN/AN/A
AcsSessionID<session>Text/StringN/A
AuthenticationIdentityStoreN/AN/AN/A
AuthenticationMethodN/AN/AN/A
SelectedAccessServiceN/AN/AN/A
WorkflowCurrentIDStoreIndexN/AN/AN/A
WorkflowSequenceTypeN/AN/AN/A
CurrentIDStoreNameN/AN/AN/A
WorkflowIfUserNotFoundN/AN/AN/A
WorkflowIfProcessError<result>Text/StringN/A
WorkflowIfAuthenticationFailed<status>Text/StringN/A
CPMSessionIDN/AN/AN/A
StepLatencyN/AN/AN/A
ResponseN/AN/AN/A
Key1N/AN/AN/A
Key2N/AN/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.