RSA Authentication Manager Log Messages (23001-23091)
The following table lists AM log messages based on the event category and action ID. It also lists the corresponding action key, description, and log message. The log message has placeholders in the “{number}” format, which represents actual data in the logs and Activity Monitor.
Use this table to understand simple network management protocol (SNMP) trap information captured by a network management system. For more information on the information displayed by the object identifier structure (OID) in the SNMP trap, see RSA Authentication Manager SNMP.
Event Category | Action ID | Action Key | Description | Message |
eventAuthn | 23001 | AUTH_UDP_PACKET | Authentication packet processing | Processing authentication packet from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23002 | AUTH_UNSUPPORTED | Received unsupported request | Received unsupported request from agent “{3}” with IP address “{4}” in security domain “{5}”. Request type: “{18}” |
eventAuthn | 23003 | AUTH_LOG_REQUEST | Authentication log request | Log request received from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23004 | AUTH_AGENT_ACCESS | Authentication agent access check | Verifying user “{0}” in security domain “{1}” from identity source “{2}” is allowed access to agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23005 | AUTH_NODE_VERIFICATION | Node secret verification | Verifying node secret for the agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23006 | AUTH_NODE_SECRET_SENT | Node secret sent | Node secret sent to agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23007 | AUTH_SECONDARY | Secondary segment processing failed | Unable to process secondary segments for request from agent “{3}” with IP address “{4}” in security domain “{5}”. Secondary segment request will be ignored |
eventAuthn | 23008 | AUTH_PRINCIPAL | Resolve principal by userid/alias | Attempting to resolve user by userid or alias “{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23009 | AUTH_SESSION_OPEATION | Session operation failure | Session operation failure processing request from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23010 | AUTH_NEW_PIN | New pin cancelled for user | New pin cancelled for user“{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23011 | CREATE_AM_TOKEN | Create Token | Administrator “{0}” attempted to create token “{4}” stored in identity source “{6}” managed in security domain “{5}” |
eventAuthn | 23012 | UPDATE_AM_TOKEN | Update Token | Administrator “{0}” attempted to update token “{4}” stored in identity source “{6}” managed in security domain “{5}” |
eventAuthn | 23013 | DELETE_AM_TOKEN | Delete Token | Administrator “{0}” attempted to delete token “{4}” stored in identity source “{6}” managed in security domain “{5}” |
eventAuthn | 23014 | AUTHMGR_TOKEN_STAT | Token Statistics Search | Administrator “{0}” attempted to search for token statistics |
eventAuthn | 23015 | OFFLINE_LOGIN_EVENT | Offline Login Event | Offline authentication attempted by user “{0}” on agent “{3}” using token with serial number “{8}” at “{10}” |
eventAuthn | 23016 | OA_DATA_DOWNLOAD | Offline Authentication Data Download | Offline authentication data download requested by user “{0}” from agent “{3}” using token “{8}” |
eventAuthn | 23017 | OA_DATA_DOWNLOAD | Offline Authentication Data Download Failed | Offline authentication data download requested by user “{0}” from agent “{3}” using token “{8}” failed with error message “{9}” |
eventAuthn | 23018 | OA_WINDOWS_PASSWORD | Windows Password Updated | Windows password updated for user “{0}” |
eventAuthn | 23019 | OA_DOMAIN_SECRET | Domain Secret Updated | Domain secret updated for agent “{3}” |
eventAuthn | 23020 | AUTHMGR_NEW_PIN | New pin mode activated for token | New pin mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23021 | AUTHMGR_NEXT | Next tokencode mode activated for token | Next tokencode mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23022 | AUTHMGR_TOKEN | Token replaced | original token deleted |
eventAuthn | 23023 | AUTHMGR_TOKEN | Token replaced | original token unassigned |
eventAuthn | 23024 | AUTHMGR_PASSCODE | Authentication attempted | Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}” |
eventAuthn | 23025 | AUTHMGR_SID_METHOD | SID method | SID method |
eventAuthn | 23026 | AUTHMGR_PIN_CHANGE | PIN change attempted | User “{0}” in security domain “{1}” from identity source “{2}” attempted to change pin for token serial number “{16}” |
eventAuthn | 23027 | AUTHMGR_FIXED_PASSCODE | Fixed passcode change | Administrator “{0}” attempted to change fixed passcode |
eventAuthn | 23028 | AUTH_AGENT_LOOKUP | Lookup Authentication agent | Lookup authentication agent by IP address “{4}” |
eventAuthn | 23029 | AGENT_AUTO_REG_START | Agent auto-registration request | Received an agent auto-registration request from IP address “{4}” |
eventAuthn | 23030 | AUTO_REG_NEW_AGENT | New authentication agent was registered with Authentication Manager | New authentication agent “{3}” with primary IP address “{4}” was registered with Authentication Manager in Security Domain “{5}” |
eventAuthn | 23031 | AUTOREG_GET_SECURITY | Getting Security Domain for agent auto-registration | Getting Security Domain for agent “{3}” with primary IP address “{4}” for auto-registration. Agent Security Domain is “{5}” |
eventAuthn | 23032 | AUTO_REG_DUPLICATE_IP | Found another agent with the same IP address while trying to auto-register an agent | Found another agent “{8}” with the same IP address “{4}” while trying to auto-register agent “{3}” |
eventAuthn | 23033 | AUTOREG_UPDATE_AGENT | Updated agent with the new IP address | Updated agent “{3}” with the new IP address “{4}” in Security Domain “{5}” |
eventAuthn | 23034 | AUTOREG_UNASSIGN_IP | While updating an agent | found another agent with the same IP address. Unassigning IP address |
eventAuthn | 23035 | AUTO_REG_DUPLICATE | Registering new agent. Found agent with the same name | Registering new agent “{3}” in Security Domain “{5}”. Found agent with the same name and IP address “{4}” |
eventAuthn | 23036 | AUTOREG_VERIFY | Agent node secret verification | Verifying node secret for the agent “{3}” with IP address “{4}” in Security Domain “{5}” |
eventAuthn | 23037 | AUTOREG_AGENT_NOT | Trying to update IP address for an agent with node secret | but it does not exist |
eventAuthn | 23038 | AUTOREG_DHCP_ERROR | While registering an agent | found another agent with the same alias IP address |
eventAuthn | 23039 | AUTOREG_CLEAR | Agent node secret has been cleared | Cleared node secret for the agent “{3}” in Security Domain “{5}” |
eventAuthn | 23040 | TR_H_AUTHMGR_PIN | Trusted Realm: PIN change attempted | User “{0}” in security domain “{1}” from identity source “{2}” in trusted realm “{13}” attempted to change pin for token serial number “{16}” |
eventAuthn | 23041 | TR_H_AUTHMGR_PASSCODE | Trusted Realm authentication attempted | Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from trusted realm “{13}” with agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}” |
eventAuthn | 23042 | TR_H_AUTHN_LOGIN_EVENT | Trusted Realm Authentication | User “{0}” attempted to authenticate using authenticator “{6}” from Trusted Realm “{13}”. The user belongs to Security Domain “{1}” |
eventAuthn | 23043 | TR_R_AUTHN_LOGIN_EVENT | Trusted Realm Authentication Requested | Trusted user “{0}” attempted to authenticate using authenticator “{8}” at trusted realm “{9}”. The user belongs to Security Domain “{1}” |
eventAuthn | 23044 | TR_R_AUTHMGR_NEXT | Trusted Realm Authentication Request activated next tokencode mode for token | Next tokencode mode activated for token serial number “{11}” assigned to user “{0}” in security domain “{1}” from the trusted realm “{8}”. |
eventAuthn | 23045 | TR_R_AUTHMGR_PIN | Trusted Realm new PIN created by user | User “{0}” in security domain “{1}” from the trusted realm “{9}” created new pin for token serial number “{10}”. |
eventAuthn | 23046 | TR_H_AUTHMGR_NEW_PIN | Trusted Realm: New pin mode activated for token | New pin mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source. Request received from trusted realm “{13}” |
eventAuthn | 23047 | TR_H_AUTHMGR_NEXT | Trusted Realm: Next tokencode mode activated for token | Next tokencode mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source. Request received from trusted realm “{13}” |
eventAuthn | 23048 | TR_R_REMOTE_PRINCIPAL | Trusted User Discovered | The trusted user “{0}” was discovered in the trusted realm “{9}”. |
eventAuthn | 23049 | TR_R_REMOTE_PRINCIPAL | Resolve user by User ID/alias/Trusted realm search | The user login “{0}” could not be discovered in the local realm or by searching configured trusted realms. |
eventAuthn | 23050 | NO_MORE_OTT | Login with One Time Tokencode Event | Token with serial number “{8}” does not have any more one time tokencodes associated with it. |
eventAuthn | 23051 | TFT_EXPIRED | Login with Temporary Fixed Tokencode Event | Fixed emergency access tokencode associated with token with serial number “{8}” has expired. |
eventAuthn | 23052 | OTTS_EXPIRED | Login with One Time Tokencode Event | One time emergency access tokencode set associated with token with serial number “{8}” has expired. |
eventAuthn | 23053 | EAP32_SESSION_RESUME | EAP-32 Authentication | User “{0}” attempted to resume the existing EAP-32 Session. |
eventAuthn | 23054 | REMOTE_AUTH_PRINCIPAL | Resolve trusted user by userid | Attempting to resolve trusted user by userid “{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23055 | AM61_MIGRATED_AUTHN | AM61 Migrated log message | AM61 Migrated log message. Original message: “{8}”. |
eventAuthn | 23056 | TR_R_REALM_DISABLED | Trusted Realm Disabled | The Trusted Realm “{9}” has rejected the connection. |
eventAuthn | 23057 | TR_R_LOCAL_REALM | Trusted Realm Disabled | The Trusted Realm “{9}” is disabled. |
eventAuthn | 23058 | NTLM_MAPPING_NOT | NTLM mapping not found | There is no NTLM mapping for “{8}”. |
eventAuthn | 23059 | FAILED_TO_LOOKUP_NTLM | Failed to lookup NTLM mapping | Could not lookup NTLM mapping for “{8}”. |
eventAuthn | 23060 | EAP32_AUTH | EAP-32 Authentication | User “{0}” attempted EAP-32 authentication |
eventAuthn | 23061 | EAP32_NEW_PEPPER | EAP-32 Authentication | User “{0}” received new EAP-32 Pepper |
eventAuthn | 23062 | TOKEN_EXPIRED | Token Expired | Token serial number “{16}” assigned to user “{0}” in security domain “{1}” from identity source “{2}” is expired |
eventAuthn | 23066 | AUTHMGR_SMS_PIN | PIN change attempted for On-Demand Tokencode Service | User “{0}” in security domain “{1}” from identity source “{2}” attempted to change pin for On-Demand Tokencode Service |
eventAuthn | 23067 | AUTHMGR_SMS_PASSCODE | Authentication attempted | Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}” |
eventAuthn | 23068 | AUTHMGR_SMS_NEW_PIN | New pin mode activated for On-Demand Tokencode Service | New pin mode activated for On-Demand Tokencode Service for user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23069 | AUTH_AGENT_TRUSTED | Authentication agent access check | Verifying trusted user “{0}” in security domain “{1}” from identity source “{2}” is allowed access to agent “{3}” with IP address “{4}” in security domain “{5}” |
eventAuthn | 23070 | AUTOREG_UPDATE_FAILED | Agent update failed | Auto-registration update for the agent “{3}” with IP address “{4}” in Security Domain “{5}” |
eventAuthn | 23071 | AUTH_FAILED_BAD | Authentication attempted | Bad tokencode ; but good PIN detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23072 | AUTH_FAILED_BAD_PIN | Authentication attempted | Bad PIN ; but good tokencode detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23073 | AUTH_FAILED_BAD_PIN | Authentication attempted | Bad PIN ; but previous tokencode detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23074 | TR_R_AUTHMGR_NTC | Trusted realm next token code accepted | Next tokencode mode accepted for token serial number “{11}” assigned to user “{0}” in security domain “{1}” from the trusted realm “{8}”. |
eventAuthn | 23079 | AUTHN_ARTIFACT | Authentication artifact validation | Authentication artifact validation on agent “{3}” with IP address “{4}” in security domain “{5}” for user “{0}” in security domain “{1}” from “{2}” identity source |
eventAuthn | 23080 | AUTH_AGENT_DOESNT | SecurID credential type not accepted | Received a SecurID credential ; which the agent is configured to not accept. Agent “{3}” with IP address “{4}” in security domain “{5}”. |
eventAuthn | 23081 | AUTHN_ARTIFACT | Generate Authentication Artifact | Authentication artifact was generated for principal “{0}” stored in identity source “{2}” managed in security domain “{1}” |
eventAuthn | 23089 | TR_R_VIA_PRINCIPAL_NOT_DISCOVERED | Discover the user | The user “{0}” could not be discovered in the RSA trusted realm |
eventAuthn | 23090 | TR_R_VIA_OTP_VERIFICATION_FAIL | Verify Authenticate Tokencode | Authenticate Tokencode verification failed for the user “{0}” |
eventAuthn | 23091 | TR_R_VIA_OTP_NODE_SECRET_UNAVAILABLE | Agent node secret verification | Verifying the node secret for the agent “{3}” with IP address “{4}” in security domain “{5}” |
Related Articles
Authentication Manager Log Messages (23001-23091) 35Number of Views How to resolve 'EXP-00000: Export terminated unsuccessfully' error encountered during Oracle Export in Thor Xellerate 6Number of Views SOFTWARE_TOKEN_NOT_AVAILABLE_IN_SYSTEM_WITH_EXP_CRITERIA error although tokens exist in RSA Authentication Manager 8.x 43Number of Views RCM 6.7 shows vulnerabilities with Apache 1.3.33 50Number of Views OIDC Relying Party Endpoints 186Number of Views
Trending Articles
Passwordless Authentication in Windows MFA Agent for Active Directory – Quick Setup Guide RSA Authentication Manager 8.9 Release Notes (January 2026) RSA Authentication Manager Upgrade Process RSA Authentication Manager 8.7 SP2 Setup and Configuration Guide An example of SSO using SAML and ADFS with RSA Identity Management and Governance 6.9.x