V 2.0 Licensing Event
Vendor Documentation
Classification
| Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| V 2.0 Licensing Event | Base Rule | General Licensing Information | Information |
| V 2.0 EVID 35000 Smart Licensing Reg. Failed | Sub Rule | General LicenseService Error | Error |
| V 2.0 EVID 35001 Smart Licensing Disabled | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35002 Smart Licensing Comm. Failure | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35003 Smart Licensing Comm. Restored | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35004 Smart License Id Cert Renew Fail | Sub Rule | General LicenseService Error | Error |
| V 2.0 EVID 35005 Smart License Id Cert Renew Succ | Sub Rule | Renew | Information |
| V 2.0 EVID 35006 Smart License Agent Out Of Comp | Sub Rule | General Cisco Security Agent Notice | Warning |
| V 2.0 EVID 35007 Smart Licensing Eval Period Exp | Sub Rule | Expired | Information |
| V 2.0 EVID 35008 Smart Licensing Auth. Expired | Sub Rule | Expired | Information |
| V 2.0 EVID 35009 Invalid Smart Licensing Request | Sub Rule | Request Not Valid | Warning |
| V 2.0 EVID 35010 License Is Set To Expire Soon | Sub Rule | License Period Will Expire Soon | Warning |
| V 2.0 EVID 35011 License Expired | Sub Rule | License Expired | Critical |
| V 2.0 EVID 35012 Device Count Exceeded | Sub Rule | License Exceeded | Critical |
| V 2.0 EVID 35013 License Deletion Failed | Sub Rule | License Deletion Failed | Error |
| V 2.0 EVID 35014 License Create Failed | Sub Rule | License Create Failed | Error |
| V 2.0 EVID 35015 License Update Failed | Sub Rule | License Update Failed | Error |
| V 2.0 EVID 35016 Smart Licensing Reg. Success | Sub Rule | Registration Complete | Information |
| V 2.0 EVID 35017 Smart Licensing Auth Renew Succ | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35018 Smart Licensing Auth Renew Fail | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35019 Smart Licensing De-Reg. Success | Sub Rule | Registration Complete | Information |
| V 2.0 EVID 35020 Smart Licensing De-Reg. Failure | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35021 Smart Licensing Id Cert Expired | Sub Rule | License Expired - Warning | Warning |
| V 2.0 EVID 35022 Smart Licensing HA Role Changed | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35023 License Expiring In 90 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35024 License Expiring In 60 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35025 License Expiring In 30 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35026 License Out Of Compl> 5 Days | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35027 License Out Of Compl> 15 Days | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35028 License Out Of Compl> 30 Days | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35029 License Out Of Compl> 45 Days | Sub Rule | License Warning | Warning |
| V 2.0 EVID 35030 License Exceeded 100% | Sub Rule | License Exceeded | Critical |
| V 2.0 EVID 35031 License Exceeded 125% | Sub Rule | License Exceeded | Critical |
| V 2.0 EVID 35032 License Expiring In 90 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35033 License Expiring In 60 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35034 License Expiring In 30 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35035 License Expired | Sub Rule | License Expired | Critical |
| V 2.0 EVID 35036 License Expiring In 90 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35037 License Expiring In 60 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35038 License Expiring In 30 Days | Sub Rule | License Nearing Expiration | Error |
| V 2.0 EVID 35039 License Expired | Sub Rule | License Expired | Critical |
| V 2.0 EVID 35040 VM Licenses Installed | Sub Rule | License Installed | Information |
| V 2.0 EVID 35041 Admin Licenses Installed | Sub Rule | License Installed | Information |
| V 2.0 EVID 35042 Comm To Satellite Server Failed | Sub Rule | Device Communication Failure | Error |
| V 2.0 EVID 35043 Comm To Satellite Server Restore | Sub Rule | Communication Restored | Information |
| V 2.0 EVID 35044 Auth Renew To Satellite Svr Succ | Sub Rule | Authorization Success | Other Audit Success |
| V 2.0 EVID 35045 Auth Renew To Satellite Svr Fail | Sub Rule | Authorization Failed | Warning |
| V 2.0 EVID 35046 License Reservation Code Success | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35047 Auth Code Installation Success | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35048 License Reservation Failed | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35049 Return Reservation Success | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35050 License Reservation, Disabled | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35051 Generate Reservation Code Succ. | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35052 Upload SLR Key Success | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35053 License Reservation | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35054 License Return Reservation Succ | Sub Rule | General Licensing Information | Information |
| V 2.0 EVID 35055 License Reservation, Disabled | Sub Rule | General Licensing Information | Information |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| pri_num | N/A | N/A | Priority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value. The facility code valid options are: LOCAL0 (Code = 16) LOCAL1 (Code = 17) LOCAL2 (Code = 18) LOCAL3 (Code = 19) LOCAL4 (Code = 20) LOCAL5 (Code = 21) LOCAL6 (Code = 22; default) LOCAL7 (Code = 23) |
| time | N/A | N/A | Date of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss. |
| IP address/hostname | N/A | N/A | IP address of the originating Cisco ISE node, or the hostname. |
| cat_name | <vendorinfo> | Text/String | Logging category name preceded by the CSCOxxx string. |
| msg_id | N/A | N/A | Unique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted. |
| total_seg | N/A | N/A | Total number of segments in a log message. Long messages are divided into more than one segment. Note: The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings. |
| seg_num | N/A | N/A | Segment sequence number within a message. Use this number to determine what segment of the message you are viewing. |
| timestamp | N/A | N/A | Date of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format : YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm. |
| sequence_num | N/A | N/A | Global counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999. |
| msg_code | <vmid> <tag1> | Number | Message code as defined in the logging categories. |
| msg_sev | <severity> | Text/String | Message severity level of a log message. |
| msg_class | <subject> | Text/String | Message class, which identifies groups of messages with the same context. |
| msg_text | <action> | Text/String | English language descriptive text message. |
| key1 | N/A | N/A | N/A |
| key2 | N/A | N/A | N/A |