V 2.0 Licensing Event

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0 Licensing Event

Base Rule

General Licensing Information

Information

V 2.0 EVID 35000 Smart Licensing Reg. Failed

Sub Rule

General LicenseService Error

Error

V 2.0 EVID 35001 Smart Licensing Disabled

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35002 Smart Licensing Comm. Failure

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35003 Smart Licensing Comm. Restored

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35004 Smart License Id Cert Renew Fail

Sub Rule

General LicenseService Error

Error

V 2.0 EVID 35005 Smart License Id Cert Renew Succ

Sub Rule

Renew

Information

V 2.0 EVID 35006 Smart License Agent Out Of Comp

Sub Rule

General Cisco Security Agent Notice

Warning

V 2.0 EVID 35007 Smart Licensing Eval Period Exp

Sub Rule

Expired

Information

V 2.0 EVID 35008 Smart Licensing Auth. Expired

Sub Rule

Expired

Information

V 2.0 EVID 35009 Invalid Smart Licensing Request

Sub Rule

Request Not Valid

Warning

V 2.0 EVID 35010 License Is Set To Expire Soon

Sub Rule

License Period Will Expire Soon

Warning

V 2.0 EVID 35011 License Expired

Sub Rule

License Expired

Critical

V 2.0 EVID 35012 Device Count Exceeded

Sub Rule

License Exceeded

Critical

V 2.0 EVID 35013 License Deletion Failed

Sub Rule

License Deletion Failed

Error

V 2.0 EVID 35014 License Create Failed

Sub Rule

License Create Failed

Error

V 2.0 EVID 35015 License Update Failed

Sub Rule

License Update Failed

Error

V 2.0 EVID 35016 Smart Licensing Reg. Success

Sub Rule

Registration Complete

Information

V 2.0 EVID 35017 Smart Licensing Auth Renew Succ

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35018 Smart Licensing Auth Renew Fail

Sub Rule

License Warning

Warning

V 2.0 EVID 35019 Smart Licensing De-Reg. Success

Sub Rule

Registration Complete

Information

V 2.0 EVID 35020 Smart Licensing De-Reg. Failure

Sub Rule

License Warning

Warning

V 2.0 EVID 35021 Smart Licensing Id Cert Expired

Sub Rule

License Expired - Warning

Warning

V 2.0 EVID 35022 Smart Licensing HA Role Changed

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35023 License Expiring In 90 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35024 License Expiring In 60 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35025 License Expiring In 30 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35026 License Out Of Compl> 5 Days

Sub Rule

License Warning

Warning

V 2.0 EVID 35027 License Out Of Compl> 15 Days

Sub Rule

License Warning

Warning

V 2.0 EVID 35028 License Out Of Compl> 30 Days

Sub Rule

License Warning

Warning

V 2.0 EVID 35029 License Out Of Compl> 45 Days

Sub Rule

License Warning

Warning

V 2.0 EVID 35030 License Exceeded 100%

Sub Rule

License Exceeded

Critical

V 2.0 EVID 35031 License Exceeded 125%

Sub Rule

License Exceeded

Critical

V 2.0 EVID 35032 License Expiring In 90 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35033 License Expiring In 60 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35034 License Expiring In 30 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35035 License Expired

Sub Rule

License Expired

Critical

V 2.0 EVID 35036 License Expiring In 90 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35037 License Expiring In 60 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35038 License Expiring In 30 Days

Sub Rule

License Nearing Expiration

Error

V 2.0 EVID 35039 License Expired

Sub Rule

License Expired

Critical

V 2.0 EVID 35040 VM Licenses Installed

Sub Rule

License Installed

Information

V 2.0 EVID 35041 Admin Licenses Installed

Sub Rule

License Installed

Information

V 2.0 EVID 35042 Comm To Satellite Server Failed

Sub Rule

Device Communication Failure

Error

V 2.0 EVID 35043 Comm To Satellite Server Restore

Sub Rule

Communication Restored

Information

V 2.0 EVID 35044 Auth Renew To Satellite Svr Succ

Sub Rule

Authorization Success

Other Audit Success

V 2.0 EVID 35045 Auth Renew To Satellite Svr Fail

Sub Rule

Authorization Failed

Warning

V 2.0 EVID 35046 License Reservation Code Success

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35047 Auth Code Installation Success

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35048 License Reservation Failed

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35049 Return Reservation Success

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35050 License Reservation, Disabled

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35051 Generate Reservation Code Succ.

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35052 Upload SLR Key Success

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35053 License Reservation

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35054 License Return Reservation Succ

Sub Rule

General Licensing Information

Information

V 2.0 EVID 35055 License Reservation, Disabled

Sub Rule

General Licensing Information

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

pri_num

N/A

N/A

Priority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value.
The facility code valid options are:
LOCAL0 (Code = 16)
LOCAL1 (Code = 17)
LOCAL2 (Code = 18)
LOCAL3 (Code = 19)
LOCAL4 (Code = 20)
LOCAL5 (Code = 21)
LOCAL6 (Code = 22; default)
LOCAL7 (Code = 23)

time

N/A

N/A

Date of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.

IP address/hostname

N/A

N/A

IP address of the originating Cisco ISE node, or the hostname.

cat_name

<vendorinfo>

Text/String

Logging category name preceded by the CSCOxxx string.

msg_id

N/A

N/A

Unique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.

total_seg

N/A

N/A

Total number of segments in a log message. Long messages are divided into more than one segment.
Note: The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.

seg_num

N/A

N/A

Segment sequence number within a message. Use this number to determine what segment of the message you are viewing.

timestamp

N/A

N/A

Date of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format :
YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.

sequence_num

N/A

N/A

Global counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.

msg_code

<vmid>
<tag1>

Number

Message code as defined in the logging categories.

msg_sev

<severity>

Text/String

Message severity level of a log message.

msg_class

<subject> 

Text/String

Message class, which identifies groups of messages with the same context.

msg_text

<action> 

Text/String

English language descriptive text message.

key1

N/A

N/A

N/A

key2

N/A

N/A

N/A