Authentication Manager Log Messages (23001-23091)
a month ago

RSA Authentication Manager Log Messages (23001-23091)

The following table lists AM log messages based on the event category and action ID. It also lists the corresponding action key, description, and log message. The log message has placeholders in the “{number}” format, which represents actual data in the logs and Activity Monitor.

Use this table to understand simple network management protocol (SNMP) trap information captured by a network management system. For more information on the information displayed by the object identifier structure (OID) in the SNMP trap, see RSA Authentication Manager SNMP.

Event Category

Action ID

Action Key

Description

Message

eventAuthn

23001

AUTH_UDP_PACKET
_PROCESSING

Authentication packet processing

Processing authentication packet from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23002

AUTH_UNSUPPORTED
_PROTOCOL

Received unsupported request

Received unsupported request from agent “{3}” with IP address “{4}” in security domain “{5}”. Request type: “{18}”

eventAuthn

23003

AUTH_LOG_REQUEST

Authentication log request

Log request received from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23004

AUTH_AGENT_ACCESS
_CHECK

Authentication agent access check

Verifying user “{0}” in security domain “{1}” from identity source “{2}” is allowed access to agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23005

AUTH_NODE_VERIFICATION

Node secret verification

Verifying node secret for the agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23006

AUTH_NODE_SECRET_SENT

Node secret sent

Node secret sent to agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23007

AUTH_SECONDARY
_SEGMENT_PROCESSING
_FAILURE

Secondary segment processing failed

Unable to process secondary segments for request from agent “{3}” with IP address “{4}” in security domain “{5}”. Secondary segment request will be ignored

eventAuthn

23008

AUTH_PRINCIPAL
_RESOLUTION

Resolve principal by userid/alias

Attempting to resolve user by userid or alias “{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23009

AUTH_SESSION_OPEATION
_FAILURE

Session operation failure

Session operation failure processing request from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23010

AUTH_NEW_PIN
_CANCELLED

New pin cancelled for user

New pin cancelled for user“{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23011

CREATE_AM_TOKEN

Create Token

Administrator “{0}” attempted to create token “{4}” stored in identity source “{6}” managed in security domain “{5}”

eventAuthn

23012

UPDATE_AM_TOKEN

Update Token

Administrator “{0}” attempted to update token “{4}” stored in identity source “{6}” managed in security domain “{5}”

eventAuthn

23013

DELETE_AM_TOKEN

Delete Token

Administrator “{0}” attempted to delete token “{4}” stored in identity source “{6}” managed in security domain “{5}”

eventAuthn

23014

AUTHMGR_TOKEN_STAT
_SEARCH

Token Statistics Search

Administrator “{0}” attempted to search for token statistics

eventAuthn

23015

OFFLINE_LOGIN_EVENT

Offline Login Event

Offline authentication attempted by user “{0}” on agent “{3}” using token with serial number “{8}” at “{10}”

eventAuthn

23016

OA_DATA_DOWNLOAD

Offline Authentication Data Download

Offline authentication data download requested by user “{0}” from agent “{3}” using token “{8}”

eventAuthn

23017

OA_DATA_DOWNLOAD
_FAILED

Offline Authentication Data Download Failed

Offline authentication data download requested by user “{0}” from agent “{3}” using token “{8}” failed with error message “{9}”

eventAuthn

23018

OA_WINDOWS_PASSWORD
_UPDATE

Windows Password Updated

Windows password updated for user “{0}”

eventAuthn

23019

OA_DOMAIN_SECRET
_UPDATE

Domain Secret Updated

Domain secret updated for agent “{3}”

eventAuthn

23020

AUTHMGR_NEW_PIN
_ACTIVATED

New pin mode activated for token

New pin mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23021

AUTHMGR_NEXT
_TOKENCODE_ACTIVATED

Next tokencode mode activated for token

Next tokencode mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23022

AUTHMGR_TOKEN
_REPLACEMENT_ORIGINAL
_DELETED

Token replaced

original token deleted

eventAuthn

23023

AUTHMGR_TOKEN
_REPLACEMENT_ORIGINAL
_UNASSIGNED

Token replaced

original token unassigned

eventAuthn

23024

AUTHMGR_PASSCODE
_REUSE

Authentication attempted

Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}”

eventAuthn

23025

AUTHMGR_SID_METHOD
_INFO

SID method

SID method

eventAuthn

23026

AUTHMGR_PIN_CHANGE

PIN change attempted

User “{0}” in security domain “{1}” from identity source “{2}” attempted to change pin for token serial number “{16}”

eventAuthn

23027

AUTHMGR_FIXED_PASSCODE
_CHANGE

Fixed passcode change

Administrator “{0}” attempted to change fixed passcode

eventAuthn

23028

AUTH_AGENT_LOOKUP

Lookup Authentication agent

Lookup authentication agent by IP address “{4}”

eventAuthn

23029

AGENT_AUTO_REG_START

Agent auto-registration request

Received an agent auto-registration request from IP address “{4}”

eventAuthn

23030

AUTO_REG_NEW_AGENT

New authentication agent was registered with Authentication Manager

New authentication agent “{3}” with primary IP address “{4}” was registered with Authentication Manager in Security Domain “{5}”

eventAuthn

23031

AUTOREG_GET_SECURITY
_DOMAIN

Getting Security Domain for agent auto-registration

Getting Security Domain for agent “{3}” with primary IP address “{4}” for auto-registration. Agent Security Domain is “{5}”

eventAuthn

23032

AUTO_REG_DUPLICATE_IP

Found another agent with the same IP address while trying to auto-register an agent

Found another agent “{8}” with the same IP address “{4}” while trying to auto-register agent “{3}”

eventAuthn

23033

AUTOREG_UPDATE_AGENT

Updated agent with the new IP address

Updated agent “{3}” with the new IP address “{4}” in Security Domain “{5}”

eventAuthn

23034

AUTOREG_UNASSIGN_IP

While updating an agent

found another agent with the same IP address. Unassigning IP address

eventAuthn

23035

AUTO_REG_DUPLICATE
_AGENT

Registering new agent. Found agent with the same name

Registering new agent “{3}” in Security Domain “{5}”. Found agent with the same name and IP address “{4}”

eventAuthn

23036

AUTOREG_VERIFY
_NODESECRET

Agent node secret verification

Verifying node secret for the agent “{3}” with IP address “{4}” in Security Domain “{5}”

eventAuthn

23037

AUTOREG_AGENT_NOT
_FOUND

Trying to update IP address for an agent with node secret

but it does not exist

eventAuthn

23038

AUTOREG_DHCP_ERROR

While registering an agent

found another agent with the same alias IP address

eventAuthn

23039

AUTOREG_CLEAR
_NODESECRET

Agent node secret has been cleared

Cleared node secret for the agent “{3}” in Security Domain “{5}”

eventAuthn

23040

TR_H_AUTHMGR_PIN
_CHANGE

Trusted Realm: PIN change attempted

User “{0}” in security domain “{1}” from identity source “{2}” in trusted realm “{13}” attempted to change pin for token serial number “{16}”

eventAuthn

23041

TR_H_AUTHMGR_PASSCODE
_REUSE

Trusted Realm authentication attempted

Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from trusted realm “{13}” with agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}”

eventAuthn

23042

TR_H_AUTHN_LOGIN_EVENT

Trusted Realm Authentication

User “{0}” attempted to authenticate using authenticator “{6}” from Trusted Realm “{13}”. The user belongs to Security Domain “{1}”

eventAuthn

23043

TR_R_AUTHN_LOGIN_EVENT

Trusted Realm Authentication Requested

Trusted user “{0}” attempted to authenticate using authenticator “{8}” at trusted realm “{9}”. The user belongs to Security Domain “{1}”

eventAuthn

23044

TR_R_AUTHMGR_NEXT
_TOKENCODE_ACTIVATED

Trusted Realm Authentication Request activated next tokencode mode for token

Next tokencode mode activated for token serial number “{11}” assigned to user “{0}” in security domain “{1}” from the trusted realm “{8}”.

eventAuthn

23045

TR_R_AUTHMGR_PIN
_CHANGE

Trusted Realm new PIN created by user

User “{0}” in security domain “{1}” from the trusted realm “{9}” created new pin for token serial number “{10}”.

eventAuthn

23046

TR_H_AUTHMGR_NEW_PIN
_ACTIVATED

Trusted Realm: New pin mode activated for token

New pin mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source. Request received from trusted realm “{13}”

eventAuthn

23047

TR_H_AUTHMGR_NEXT
_TOKENCODE_ACTIVATED

Trusted Realm: Next tokencode mode activated for token

Next tokencode mode activated for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source. Request received from trusted realm “{13}”

eventAuthn

23048

TR_R_REMOTE_PRINCIPAL
_DISCOVERED

Trusted User Discovered

The trusted user “{0}” was discovered in the trusted realm “{9}”.

eventAuthn

23049

TR_R_REMOTE_PRINCIPAL
_NOT_DISCOVERED

Resolve user by User ID/alias/Trusted realm search

The user login “{0}” could not be discovered in the local realm or by searching configured trusted realms.

eventAuthn

23050

NO_MORE_OTT

Login with One Time Tokencode Event

Token with serial number “{8}” does not have any more one time tokencodes associated with it.

eventAuthn

23051

TFT_EXPIRED

Login with Temporary Fixed Tokencode Event

Fixed emergency access tokencode associated with token with serial number “{8}” has expired.

eventAuthn

23052

OTTS_EXPIRED

Login with One Time Tokencode Event

One time emergency access tokencode set associated with token with serial number “{8}” has expired.

eventAuthn

23053

EAP32_SESSION_RESUME

EAP-32 Authentication

User “{0}” attempted to resume the existing EAP-32 Session.

eventAuthn

23054

REMOTE_AUTH_PRINCIPAL
_RESOLUTION

Resolve trusted user by userid

Attempting to resolve trusted user by userid “{0}”. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23055

AM61_MIGRATED_AUTHN
_LOG_MESSAGE

AM61 Migrated log message

AM61 Migrated log message. Original message: “{8}”.

eventAuthn

23056

TR_R_REALM_DISABLED

Trusted Realm Disabled

The Trusted Realm “{9}” has rejected the connection.

eventAuthn

23057

TR_R_LOCAL_REALM
_DISABLED

Trusted Realm Disabled

The Trusted Realm “{9}” is disabled.

eventAuthn

23058

NTLM_MAPPING_NOT
_FOUND

NTLM mapping not found

There is no NTLM mapping for “{8}”.

eventAuthn

23059

FAILED_TO_LOOKUP_NTLM
_MAPPINGS

Failed to lookup NTLM mapping

Could not lookup NTLM mapping for “{8}”.

eventAuthn

23060

EAP32_AUTH

EAP-32 Authentication

User “{0}” attempted EAP-32 authentication

eventAuthn

23061

EAP32_NEW_PEPPER

EAP-32 Authentication

User “{0}” received new EAP-32 Pepper

eventAuthn

23062

TOKEN_EXPIRED

Token Expired

Token serial number “{16}” assigned to user “{0}” in security domain “{1}” from identity source “{2}” is expired

eventAuthn

23066

AUTHMGR_SMS_PIN
_CHANGE

PIN change attempted for On-Demand Tokencode Service

User “{0}” in security domain “{1}” from identity source “{2}” attempted to change pin for On-Demand Tokencode Service

eventAuthn

23067

AUTHMGR_SMS_PASSCODE
_REUSE

Authentication attempted

Passcode reuse or previous token code detected for user “{0}” in security domain “{1}” from “{2}” identity source. Request originated from agent “{3}” with IP address “{4}” in security domain “{5}” with protocol version “{2}”. Authentication method: “{6}” ; Authentication policy exp: “{7}”

eventAuthn

23068

AUTHMGR_SMS_NEW_PIN
_ACTIVATED

New pin mode activated for On-Demand Tokencode Service

New pin mode activated for On-Demand Tokencode Service for user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23069

AUTH_AGENT_TRUSTED
_USER_ACCESS_CHECK

Authentication agent access check

Verifying trusted user “{0}” in security domain “{1}” from identity source “{2}” is allowed access to agent “{3}” with IP address “{4}” in security domain “{5}”

eventAuthn

23070

AUTOREG_UPDATE_FAILED

Agent update failed

Auto-registration update for the agent “{3}” with IP address “{4}” in Security Domain “{5}”

eventAuthn

23071

AUTH_FAILED_BAD
_TOKENCODE_GOOD_PIN

Authentication attempted

Bad tokencode ; but good PIN detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23072

AUTH_FAILED_BAD_PIN
_GOOD_TOKENCODE

Authentication attempted

Bad PIN ; but good tokencode detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23073

AUTH_FAILED_BAD_PIN
_PREVIOUS_TOKENCODE

Authentication attempted

Bad PIN ; but previous tokencode detected for token serial number “{16}” assigned to user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23074

TR_R_AUTHMGR_NTC
_ACCEPTED

Trusted realm next token code accepted

Next tokencode mode accepted for token serial number “{11}” assigned to user “{0}” in security domain “{1}” from the trusted realm “{8}”.

eventAuthn

23079

AUTHN_ARTIFACT
_VALIDATION

Authentication artifact validation

Authentication artifact validation on agent “{3}” with IP address “{4}” in security domain “{5}” for user “{0}” in security domain “{1}” from “{2}” identity source

eventAuthn

23080

AUTH_AGENT_DOESNT
_ACCEPT_SECURID

SecurID credential type not accepted

Received a SecurID credential ; which the agent is configured to not accept. Agent “{3}” with IP address “{4}” in security domain “{5}”.

eventAuthn

23081

AUTHN_ARTIFACT
_GENERATION

Generate Authentication Artifact

Authentication artifact was generated for principal “{0}” stored in identity source “{2}” managed in security domain “{1}”

eventAuthn

23089

TR_R_VIA_PRINCIPAL_NOT_DISCOVERED

Discover the user

The user “{0}” could not be discovered in the RSA trusted realm

eventAuthn

23090

TR_R_VIA_OTP_VERIFICATION_FAIL

Verify Authenticate Tokencode

Authenticate Tokencode verification failed for the user “{0}”

eventAuthn

23091

TR_R_VIA_OTP_NODE_SECRET_UNAVAILABLE

Agent node secret verification

Verifying the node secret for the agent “{3}” with IP address “{4}” in security domain “{5}”