Syslog Events

Each syslog message contains the name of the event that triggered the message to be logged. While a number of syslog events are defined by the BeyondTrust Appliance B Series, most of the event types are defined within the /login administrative interface and are triggered by actions such as login attempts, user creation, and so forth. The representative console also triggers syslog messages, but only for login and logout attempts.

Below is a comprehensive list of the possible events included with this version of BeyondTrust software, accompanied by a brief description of each event.

Some events may be caused by multiple triggers. In those cases, the triggers are identified below.

Event Trigger
account_group_added A new account group has been added and saved.
account_group_changed An existing account group has been modified and saved.
account_group_removed An existing account group has been deleted.
account_added A new account has been added and saved.
account_changed An existing account has been modified and saved.
account_removed An existing account has been deleted.
account_jump_item_association_added An association with a Jump Item was added for the account.
account_jump_item_association_changed An association with a Jump Item was changed for the account.
account_jump_item_direct_association_added The account is allowed to be injected for the specific Jump Items.
account_jump_item_direct_association_removed The account is removed from the allowed list to be injected for the specific Jump Items.
accounts_changed A group of one or more accounts was modified.

access_sponsor_group_added

A new access sponsor group has been defined and saved.

access_sponsor_group_changed

An existing access sponsor group’s name or description has been changed, and the change has been saved.

access_sponsor_group_member_added

A new member has been added to an access sponsor group, and the group has been saved.

access_sponsor_group_member_changed

An existing member has been assigned to a different role in an access sponsor group, and the group has been saved.

access_sponsor_group_member_removed

An existing member has been deleted from an access sponsor group, and the group has been saved.

access_sponsor_group_removed

An existing access sponsor group has been deleted.

admin_password_reset_to_factory_default

The Reset Admin Account button has been clicked, reverting a site’s administrative account to its default credentials.

api_account_added A new API account has been added and saved.
api_account_changed An existing API account has been modified and saved.
api_account_removed An existing API account has been deleted.

backup_created

A backup of the current software configuration has been saved.

canned_message_added

A new canned message has been added and saved.

canned_message_category_added

A new canned message category has been added and saved.

canned_message_cateogry_changed

An existing canned message category has been modified and saved.

canned_message_category_removed

An existing canned message category has been deleted.

canned_message_changed

An existing canned message has been modified and saved.

canned_message_removed

An existing canned message has been deleted.

canned_message_team_added

A canned message has been newly assigned to a team, and the message has been saved.

canned_message_team_changed

A canned message has been edited, and this team has neither been added nor removed.

canned_message_team_removed

A previously assigned canned message has been unassigned from a team, and the message has been saved.

canned_script_added

A new canned script has been added and saved.

canned_script_category_added

A canned script has been newly assigned to a category, and the script has been saved.

canned_script_category_removed

A previously assigned canned message has been unassigned from a category, and the script has been saved.

canned_script_changed

An existing canned script’s name, description, or command sequence has been changed, and the change has been saved.

canned_script_file_added

A resource file has been newly associated with a canned script, and the script has been saved.

canned_script_file_removed

A previously associated resource file has been removed from a canned script, and the script has been saved.

canned_script_removed

An existing canned script has been deleted.

canned_script_team_added

A support team has been newly assigned to a canned script, and the script has been saved.

canned_script_team_removed

A previously assigned support team has been unassigned from a canned script, and the script has been saved.

canned_scripts_category_added

A new canned scripts category has been created.

canned_scripts_category_removed

An existing canned scripts category has been deleted.

canned_scripts_file_added

A new canned script resource file has been uploaded.

canned_scripts_file_removed

An existing canned script resource file has been deleted.

certificate_export

An SSL certificate has been exported from the BeyondTrust Appliance B Series.

change_display_name

A user has attempted to change their display name.

change_password

A user has attempted to change their password.

change_username

A user has attempted to change their username.

cust_exit_survey_question_added

A new customer exit survey question has been added and saved.

cust_exit_survey_question_changed

An existing customer exit survey question has been edited and saved.

cust_exit_survey_question_option_added

A new option, such as a radio button, check box, or menu item, has been added to a customer exit survey question, and the question has been saved.

cust_exit_survey_question_option_changed

An existing option for a customer exit survey question, such as a radio button, check box, or menu item, has been edited, and the question has been saved.

cust_exit_survey_question_option_removed

An existing option for a customer exit survey question, such as a radio button, check box, or menu item, has been removed, and the question has been saved.

cust_exit_survey_question_removed

An existing customer exit survey question has been deleted.

custom_rep_link_added A new custom link has been added and saved.
custom_rep_link_changed An existing custom link has been edited and saved.
custom_rep_link_removed An existing custom link has been deleted.

custom_session_attribute_added

A new custom field for API integration has been added and saved.

custom_session_attribute_changed

An existing custom field for API integration has been edited and saved.

custom_session_attribute_removed

An existing custom field for API integration has been removed.

custom_session_policy_added

Custom session permissions have been added to a user account, and the user account has been saved.

custom_session_policy_changed

Existing custom session permissions have been edited, and the user account has been saved.

custom_session_policy_removed

Existing custom session permissions have been removed from a user account, and the user account has been saved.

custom_special_action_added

A new custom special action has been added and saved.

custom_special_action_changed

An existing custom special action has been edited and saved.

custom_special_action_removed

An existing custom special action has been removed.

customer_notice_added

A new customer notice has been added and saved.

customer_notice_changed

An existing customer notice has been edited and saved.

customer_notice_public_site_added

A customer notice has been enabled for a public site, and the customer notice has been saved.

customer_notice_public_site_removed

A customer notice has been disabled for a public site, and the customer notice has been saved.

customer_notice_removed

An existing customer notice has been removed.

customizable_text_changed

An existing customer greeting, on-hold message, or login agreement has been changed.

default_site_changed

The default support site for this B Series Appliance has been changed to another site, and the change has been saved.

discovery_error_added A new Discovery job error has been added.
discovery_error_changed A new Discovery job error has been changed.
discovery_error_removed A new Discovery job error has been removed.
domain_added A new Vault domain has been added and saved.
domain_changed An existing Vault domain has been modified and saved.
domain_removed An existing Vault domain has been deleted.

downloaded_rep_client

A user has clicked the link to download the representative console.

endpoint_changed An existing endpoint has been modified and saved.
endpoint_removed An existing endpoint has been deleted.
eula_accepted The BeyondTrust Cloud end-user license agreement (EULA) has been accepted by a user, and the username has been recorded.

fido2_credential_added

A new FIDO2 Autheticator has been added and saved.

fido2_credential_changed

An existing FIDO2 Autheticator has been modified and saved.

fido2_credential_removed

An existing FIDO2 Autheticator has been deleted.

file_removed_from_file_store

A file has been deleted from the file store.

file_uploaded_to_file_store

A file has been added to the file store.

group_policy_added

A new group policy has been created and saved.

group_policy_changed

An existing group policy’s priority level has changed, and the change has been saved.

group_policy_member_added

A new member has been added to a group policy, and the policy has been saved.

group_policy_member_removed

An existing member has been removed from a group policy, and the policy has been saved.

group_policy_removed

An existing group policy has been deleted.

group_policy_setting_added

A group policy setting has been designated as defined in this policy, and the policy has been saved.

group_policy_setting_changed

An existing group policy setting or override status has been changed, and the policy has been saved.

group_policy_setting_removed

A group policy setting previously defined in this policy has been removed, and the policy has been saved.

ios_content_item_added

A new iOS configuration profile has been created and saved.

ios_content_item_changed

An existing iOS configuration profile has had a new file uploaded or has had its public availability changed, and the profile has been saved.

ios_content_item_removed

An existing iOS configuration profile has been deleted.

jump_item_role_added A new Jump Item Role has been created and saved.
jump_item_role_changed An existing Jump Item Role has been modified and saved.
jump_item_role_removed An existing Jump Item Role has been deleted.

jump_policy:schedule_entry_added

A new schedule entry has been added to a Jump Policy, and the policy has been saved.

jump_policy:schedule_entry_removed

An existing schedule entry has been removed from a Jump Policy, and the policy has been saved.

jump_policy_added

A new Jump Policy has been created and saved.

jump_policy_changed

An existing Jump Policy has been modified and saved.

jump_policy_removed

An existing Jump Policy has been deleted.

jumpoint_cluster_added A new Jumpoint or Jumpoint cluster has been created and saved.
jumpoint_cluster_changed An existing Jumpoint or Jumpoint cluster has been changed.
jumpoint_cluster_removed An existing Jumpoint or Jumpoint cluster has been deleted.

jumpoint_user_added

A new member has been added to a Jumpoint, and the Jumpoint has been saved.

jumpoint_user_removed

An existing member has been removed from a Jumpoint, and the Jumpoint has been saved.

kerberos_keytab_added

A new Kerberos keytab has been uploaded.

kerberos_keytab_removed

An existing Kerberos keytab has been deleted.

license_pool_added A new license pool has been created and saved.
license_pool_changed An existing license pool has been changed, and the license pool has been saved.
license_pool_removed An existing license pool has been deleted.

license_usage_report_generated

A report of peak license usage has been run.

login

A login attempt has been made.

login_schedule_entry_added

A new login schedule entry has been added to a user's, or group policy's login schedule, and the user account or group policy has been saved.

login_schedule_entry_removed

An existing login schedule entry has been removed from a user's, or group policy's login schedule, and the user or group policy has been saved.

logout

A user has logged out of the representative console, whether by deliberate action, by an administrator, or as the result of a lost connection to the BeyondTrust Appliance B Series.

management_account_added A new management account has been added and saved.
management_account_changed An existing management account has been modified and saved.
management_account_removed An existing management account has been deleted.
msgraph_http_recipient_added A new service principal has been added and saved.
msgraph_http_recipient_changed An existing service principal has been modified and saved.
msgraph_http_recipient_removed An existing service principal has been deleted.

network_address_added

A new IP address has been added and saved.

network_address_changed

An existing IP address has been modified and saved.

network_address_removed

An existing IP address has been deleted

You cannot delete the default route.

network_changed

The global network configuration has been changed, and the change has been saved.

network_route_changed

A static route has been added, modified, or removed.

network_tunnel_jump_item_added A network tunnel Jump Item has been added.
network_tunnel_jump_item_changed A network tunnel Jump Item has been changed and saved.
network_tunnel_jump_item_removed A network tunnel Jump Item has been removed.

outbound_event_email_recipient_added

A new email outbound event has been added and saved.

outbound_event_email_recipient_changed

An existing email outbound event has been modified and saved.

outbound_event_email_recipient_removed

An existing email outbound event has been deleted.

outbound_event_email_trigger_added

A new trigger has been added for an email outbound event, and the event has been saved.

outbound_event_email_trigger_removed

An existing trigger for an email outbound event has been removed, and the event has been saved.

outbound_event_http_recipient_added

A new HTTP outbound event has been added and saved.

outbound_event_http_recipient_changed

An existing HTTP outbound event has been modified and saved.

outbound_event_http_recipient_removed

An existing HTTP outbound event has been deleted.

outbound_event_http_trigger_added

A new trigger has been added for an HTTP outbound event, and the event has been saved.

outbound_event_http_trigger_removed

An existing trigger for an HTTP outbound event has been removed, and the event has been saved.

pdcust_banner_reverted_to_factory_default

The banner image for the presentation attendee client has been reverted to the default image.

pdcust_banner_uploaded

A new banner image for the presentation attendee client has been uploaded to the site.

presentation_session_detail_generated

A detailed report has been run for a presentation session.

presentation_session_report_generated

A report of presentation sessions has been run.

public_site_added

A new public site has been created and saved.

public_site_address_added

A hostname has been added to a public site, and the site has been saved.

public_site_address_removed

A hostname has been removed from a public site, and the site has been saved.

public_site_changed

An existing public site has been changed.

public_site_customer_banner_reverted_to_factory_default

The banner image for the customer client has been reverted to the default image.

public_site_customer_banner_uploaded

A new banner image for the customer client has been uploaded to the site.

public_site_exit_survey_added

A question has been added to a public site’s customer or representative survey, and the site has been saved.

public_site_exit_survey_removed

A question has been removed from a public site’s customer or representative survey, and the site has been saved.

public_site_removed

An existing public site has been deleted.

public_site_session_attribute_added A public site session attribute has been added.
public_site_session_attribute_changed A public site session attribute has been changed.
public_site_session_attribute_removed A public site session attribute has been removed.

public_site_setting_added

A public site setting has been defined for the first time, and the site has been saved.

public_site_setting_changed

A public site setting has been modified, and the site has been saved.

public_site_team_added

A support team’s issues have been added to a public site’s front-end survey, and the site has been saved.

public_site_team_removed

A support team’s issues have been removed from a public site’s front-end survey, and the site has been saved.

public_site_template_asset_uploaded

A new HTML asset file has been uploaded to the site.

public_site_template_asset_reverted

An HTML template asset file has been reverted to the default.

public_template_deleted

An HTML template has been removed.

public_template_written

An HTML template has been modified and saved.

reboot

The BeyondTrust Appliance B Series has been rebooted.

remote_rfb_jump_item_added A Remote RFB Jump Item has been added.
remote_rfb_jump_item_removed A Remote RFB Jump Item has been removed.

rep_client_connection_terminated

An administrator has terminated a representative’s connection.

rep_console_setting_added

A managed representative console setting has been defined for the first time, and the settings have been saved.

rep_console_setting_changed

A managed representative console setting has been changed, and the settings have been saved.

rep_console_setting_removed

A managed representative console setting has been marked as undefined, and the settings have been saved.

rep_exit_survey_question_added

A new representative survey question has been added and saved.

rep_exit_survey_question_changed

A representative survey question has been edited and saved.

rep_exit_survey_question_option_added

A new option, such as a radio button, check box, or menu item, has been added to a representative survey question, and the question has been saved.

rep_exit_survey_question_option_changed

An existing option for a representative survey question, such as a radio button, check box, or menu item, has been edited, and the question has been saved.

rep_exit_survey_question_option_removed

An existing option, such as a radio button, check box, or menu item, has been removed from a representative survey question, and the question has been saved.

rep_exit_survey_question_removed

An existing representative survey question has been deleted.

rep_invite_added

A session policy has been made available for rep invites, and the session policy has been saved.

rep_invite_removed

A session policy has been made unavailable for rep invites and has been saved, or a session policy available for rep invites has been deleted.

repinvite_setting_added

A rep invite setting has been added because a session policy has been made available for rep invites, and the session policy has been saved.

repinvite_setting_removed

A rep invite setting has been removed either because a session policy has been made unavailable for rep invites and has been saved, or because a session policy available for rep invites has been deleted.

reporting_erasure Session reports have had representative or customer data anonymized.

restored_from_backup

The software configuration has been successfully restored from its backup file.

restoring_from_backup

The software configuration is in the process of restoring from its backup file.

scheduled_discovery_job_added The domain scheduled discovery has been added.
scheduled_discovery_job_changed The domain scheduled discovery has been changed.

sdcust_exit_survey_report_generated

A report of customer exit survey results has been run.

sdrep_exit_survey_report_generated

A report of representative survey results has been run.

security_provider_added

A new security provider configuration has been added and saved.

security_provider_changed

An existing security provider configuration’s priority level has changed, and the change has been saved.

security_provider_removed

An existing security provider configuration has been deleted.

security_provider_setting_added

A security provider setting has been added as part of the initial configuration, and the configuration has been saved.

security_provider_setting_changed

An existing security provider configuration has been modified and saved.

security_provider_setting_removed

A security provider setting has been removed as part of the deletion of a security provider configuration.

session_policy_added

A new session policy has been added and saved.

session_policy_changed

An existing session policy has been modified and saved.

session_policy_removed

An existing session policy has been deleted.

server_software_restarted

The BeyondTrust software has been restarted.

setting_added

A setting has been defined and saved for the first time.

setting_changed

A setting has been modified and saved.

skill_added

A new skill has been added and saved.

skill_changed

An existing skill has been modified and saved.

skill_removed

An existing skill has been deleted.

SNMP_changed

The SNMPv2 Server has been changed.

ssh_account_added An SSH account has been added.
ssh_account_changed An SSH account has been modified and saved.
ssh_account_removed An SSH account has been removed.

starting_support_tunnel

A support tunnel has been initiated from the BeyondTrust Appliance B Series.

support_button_profile_added

A new Support Button profile has been added and saved.

support_button_profile_changed

An existing Support Button profile has been changed and saved.

support_button_profile_icon_uploaded

A new icon has been uploaded to a Support Button profile.

support_button_profile_removed

An existing Support Button profile has been deleted.

support_issue_added

A new support issue has been added and saved.

support_issue_changed

An existing support issue has been modified and saved.

support_issue_removed

An existing support issue has been deleted.

support_issue_skill_added

A new skill has been assigned to a support issue, and the issue has been saved.

support_issue_skill_removed

An existing skill has been removed from a support issue, and the issue has been saved.

support_session_detail_generated

A detailed report has been run for a support session.

support_session_report_generated

A report of support sessions has been run.

support_session_summary_report_generated

A summary report of support sessions has been run.

support_team_added

A support team has been added.

support_team_changed

A support team has been changed.

support_team_jump_access_added

A team has been granted access to another team's Jump Clients, and the change has been saved.

support_team_jump_access_removed

A team's access to another team's Jump Clients has been removed, and the change has been saved.

support_team_member_added

A new member has been added to a team, and the team has been saved.

support_team_member_changed

An existing member has been assigned a different role in a team, and the team has been saved.

support_team_member_removed

An existing member has been deleted from a team, and the team has been saved.

support_team_removed

An existing support team has been deleted.

syslog_server_changed

The remote syslog server setting has been changed and saved.

team_activity_report_generated

A team activity report has been run.

user_account_report_generated

A user account report has been generated.

user_added

A new local user has been created and saved. Event fields differ between /login users and /appliance users.

user_changed

An existing local user has been modified and saved. Event fields differ between /login users and /appliance users.

user_removed

An existing local user has been deleted. Event fields differ between /login users and /appliance users.

user_session_policy_added

A session policy has been applied to a user account, and the user account has been saved.

user_session_policy_removed

A session policy has been removed from a user account, and the user account has been saved.

user_skill_added

A new skill has been assigned to a user, and the user account has been saved.

user_skill_removed

An existing skill has been removed from a user, and the user account has been saved.

vault_account_password_rotation Vault account password has been rotated.