RSA Authentication Manager Log Messages
The following table lists AM log messages based on the event category and action ID. It also lists the corresponding action key, description, and log message. The log message has placeholders in the “{number}” format, which represents actual data in the logs and Activity Monitor.
Use this table to understand simple network management protocol (SNMP) trap information captured by a network management system. For more information on the information displayed by the object identifier structure (OID) in the SNMP trap, see RSA Authentication Manager SNMP.
Event Category | Action ID | Action Key | Description | Message |
eventSystem | 16001 | LICENSE_INSTALL | Install license | Administrator “{0}” attempted to install license “{4}” for “{3}” |
eventSystem | 16002 | LICENSE_REPLACEMENT | Replace license | Administrator “{0}” attempted to replace license “{5}” for “{3}” with license “{4}” |
eventSystem | 16003 | LICENSE_UNINSTALL | Uninstall license | Administrator “{0}” attempted to uninstall license “{4}” for “{3}” |
eventSystem | 16004 | LICENSE_CHECK | Check license | System attempted to check the license for product “{3}” “{4}” on instance “{5}” |
eventSystem | 16005 | LICENSE_GET | Retrieve license from the database | System attempted to retrieve a license from the database with filter “{3}” |
eventSystem | 16006 | FEATURE_LICENSE_CHECK | Check license for feature | System attempted to check the license for feature “{6}” of “{3}” “{4}” on instance “{5}” |
eventSystem | 16007 | ARCHIVE_LOG | Log archived | Messages in log “{3}” archived from dates “{4}” through “{5}” |
eventSystem | 16008 | PLUGIN_LOADED | Load plug-in | System attempted to load plug-in “{3}” from file “{4}” |
eventSystem | 16009 | EXTENSION_LOADED | Load extension point | System attempted to load extension point “{4}” from plug-in “{3}” |
eventSystem | 16010 | SETUP_PRIMARY | Setup primary | Replication “{3}” “{4}” succeeded |
eventSystem | 16011 | REMOVE_PRIMARY | Remove primary | Replication “{3}” “{4}” succeeded |
eventSystem | 16012 | PROMOTE_PRIMARY | Promote primary | Replication “{3}” “{4}” succeeded |
eventSystem | 16013 | ADD_REPLICA | Add replica | Replication “{3}” “{4}” succeeded |
eventSystem | 16014 | REMOVE_REPLICA | Remove replica | Replication “{3}” “{4}” succeeded |
eventSystem | 16015 | ATTACH_REPLICA | Attach replica | Replication “{3}” “{4}” succeeded |
eventSystem | 16016 | SYNCHRONIZE_REPLICA | Synchronize replica | Replication “{3}” “{4}” succeeded |
eventSystem | 16017 | REGISTRY_TOPOLOGY_READ | Read cluster topology | System attempted to retrieve the cluster topology |
eventSystem | 16018 | REGISTRY_TOPOLOGY | Update cluster topology | System attempted to update the cluster topology for instance “{3}” |
eventSystem | 16019 | REGISTRY_INSTANCE | Register instance | Administrator “{0}” attempted to register instance “{3}” |
eventSystem | 16020 | REGISTRY_INSTANCE | Update instance | Administrator “{0}” attempted to update instance “{3}” |
eventSystem | 16021 | REGISTRY_INSTANCE | Deregister instance | Administrator “{0}” attempted to deregister instance with ID “{3}” |
eventSystem | 16022 | REGISTRY_INSTANCE | Look up instance | Administrator “{0}” attempted to read an instance |
eventSystem | 16023 | REGISTRY_COMPONENT | Register component | Administrator “{0}” attempted to register component “{4}” on instance “{3}” |
eventSystem | 16024 | REGISTRY_COMPONENT | Update component | Administrator “{0}” attempted to update component “{4}” on instance “{3}” |
eventSystem | 16025 | REGISTRY_COMPONENT | Deregister component | Administrator “{0}” attempted to deregister component “{4}” from instance “{3}” |
eventSystem | 16026 | REGISTRY_COMPONENT | Look up component | Administrator “{0}” attempted to read a component |
eventSystem | 16027 | REGISTRY_PATCH_ADD | Add component patch | Administrator “{0}” attempted to add patch “{5}” to component “{4}” on instance “{3}” |
eventSystem | 16028 | REGISTRY_PATCH_REMOVE | Remove component patch | Administrator “{0}” attempted to remove patch “{5}” from component “{4}” on instance “{3}” |
eventSystem | 16029 | REGISTRY_CLUSTER | Cluster topology updated | Cluster topology for instance “{3}” has been updated |
eventSystem | 16030 | REGISTRY_CLUSTER | Cluster topology unchanged | Cluster topology for instance “{3}” has not been changed |
eventSystem | 16031 | REGISTRY_INITIALIZATION | Initialize registry | System attempted to initialize the registry |
eventSystem | 16032 | DELETE_BATCH_JOB | Delete batch job | Administrator “{0}” attempted to delete batch job “{8}” |
eventSystem | 16033 | EXECUTE_BATCH_JOB | Execute batch job | Administrator “{0}” attempted to execute batch job “{3}”: “{4}” |
eventSystem | 16034 | READ_BATCH_JOB | Read batch job | Administrator “{0}” attempted to read batch job “{8}” |
eventSystem | 16035 | READ_SCHEDULE_JOB | Read scheduled job | Administrator “{0}” attempted to read scheduled job “{8}” |
eventSystem | 16036 | ADD_BATCH_JOB | Add batch job | Administrator “{0}” attempted to add batch job “{8}” |
eventSystem | 16037 | SCHEDULE_BATCH_JOB | Schedule batch job | Administrator “{0}” attempted to schedule batch job “{8}” |
eventSystem | 16038 | DELETE_SCHEDULE_JOB | Delete scheduled job | Administrator “{0}” attempted to delete scheduled job “{8}” |
eventSystem | 16039 | CANCEL_BATCH_JOB | Cancel batch job | Administrator “{0}” attempted to cancel batch job “{8}” |
eventSystem | 16040 | CANCEL_SCHEDULE_JOB | Cancel scheduled job | Administrator “{0}” attempted to cancel scheduled job “{8}” |
eventSystem | 16041 | DELETE_AGED_JOB | Delete aged job | Administrator “{0}” attempted to delete aged job “{3}” |
eventSystem | 16042 | EXECUTE_COMMAND | Execute command | Administrator “{0}” attempted to execute command “{3}” |
eventSystem | 16043 | CONDITION_EVALUATION | Evaluate condition | Administrator “{0}” attempted to evaluate the expression “{3}” |
eventSystem | 16044 | ACCESS_DATABASE | Database access | Database access attempted by system |
eventSystem | 16045 | ACCESS_DIRECTORY | Directory access | Administrator “{0}” attempted to access directory “{3}” |
eventSystem | 16046 | CREATE_REALM | Create realm | Administrator “{0}” attempted to create a realm |
eventSystem | 16047 | DELETE_REALM | Delete realm | Administrator “{0}” attempted to delete a realm |
eventSystem | 16048 | UPDATE_REALM | Update realm | Administrator “{0}” attempted to update a realm |
eventSystem | 16049 | READ_REALM | Read realm | Administrator “{0}” attempted to read a realm |
eventSystem | 16050 | CREATE_SECURITY_DOMAIN | Create security domain | Administrator “{0}” attempted to create a security domain |
Related Articles
Smartsheet - SAML Relying Party Configuration - RSA Ready Implementation Guide 14Number of Views How to move the RSA Federated Identity Manager (FIM) database 7Number of Views RSA SecurID Hardware Token Data Sheet 42Number of Views RSA DLP Datacenter temporary vs permanent agents 30Number of Views Authentication Manager Log Messages (10251-10294) 34Number of Views
Trending Articles
Passwordless Authentication in Windows MFA Agent for Active Directory – Quick Setup Guide RSA Authentication Manager Upgrade Process RSA Authentication Manager 8.9 Release Notes (January 2026) An example of SSO using SAML and ADFS with RSA Identity Management and Governance 6.9.x RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide