List of events that Cayosoft Administrator posts to the Windows Event Log

Summary: Cayosoft Administrator writes events related to the most important operations in the service to Windows Event Log into Windows Logs > Application. Change History information can optionally be written to a separate event. In this article, you can find the detailed description of events that are created by Cayosoft Administrator service. This information could be useful when integrating with log management applications such as Splunk, or similar.

Applies to: Cayosoft Administrator 4.X or later.

ID: KB20180919-1

General Events that Cayosoft Administrator writes to Windows Event Log

Cayosoft Administrator service writes all events to Windows Event Log under Windows Logs > Application node with Source Cayosoft Administrator Service.

Please see the table below with all events that might be generated by Cayosoft Administrator service to Event Log.

Note: Certain event data contains placeholders in angle brackets (for example, SMTP Server Name: <smtp server>). In the actual Event, these events will be populated with real data.

Note 2: You can find rule or web action initiator in Event Data using the Initiator field (in versions prior to 6.2 this could also be Executed by or Requestor fields). If a rule was started by service itself, the initiator is written as 'Policy Service'.

Change History Events

Change History events can be written to the Windows Event Log by enabling the corresponding checkbox under Home > Configuration > Settings > Change History: 

Cayosoft Administrator service writes all change history records to Windows Event Log under Windows Logs > Application node using the same Cayosoft Administrator Service source and the Event ID 2615

The details of the change are included in the event in a JSON format that follows this format:

{
"Action": "<Action name, like 'New User'>",
"ObjectName": "<Object name>",
"ObjectClass": "<Class like 'user' or 'group'>",
"ObjectPath": "<OU or location of object>",
"ClientIP": "<IP of client, including Web>",
"Comment": "",
"WorkItemId": "",
"Initiator": "<Initiator>",
"InitiatorId": "<Initiator SID>",
"Timestamp": "<format like 2020-09-23T18:12:08.1363927+08:00>",
"ObjectId": "<GUID>",
"RuleId": "<GUID>",
"CorrelationID": "<GUID>",
"OperationType": "<Create | Update | Delete>",
"ModifiedProperties": [
  { 
   "Property": "<Property 1 name>",
    "PreviousValue": "<old value>",
    "NewValue": "<new value>"
  },
 {
    "Property": "<Property 2 name>",
    "PreviousValue": "<old value>",
    "NewValue": "<new value>"
 }

Change History