## Content revision state events on the management server

Content revision state events are written to the Windows Event Log on the management server and on the client.

Content revision state on the management server is important if the server is configured to provide client updates.

Note: | Content revision state events are written separately for each content type that the management server is registered to download. For a list of the available content types, see the Symantec Endpoint Protection documentation.

See Monitoring the management server.

Table:

Event Source | Category | EventID | Type | Target Log | Message Text
--- | --- | --- | --- | --- | ---
SEPM | Content | 7200 | Information | Symantec Endpoint Protection Manager | [prefix:] Content was successfully downloaded to the Symantec Endpoint Protection management server. [details:] See Table: Content message text details.
SEPM | Content | 7201 | Information | Symantec Endpoint Protection Manager | [prefix:] Content could not be downloaded to the Symantec Endpoint Protection management server. [details:] See Table: Content message text details.
SEPM | Content | 7202 | Information | Symantec Endpoint Protection Manager | [prefix:] Content was successfully installed on the Symantec Endpoint Protection management server. [details:] See Table: Content message text details.
SEPM | Content | 7203 | Warning | Symantec Endpoint Protection Manager | [prefix:] Content could not be installed on the Symantec Endpoint Protection management server. [details:] See Table: Content message text details.
SEPM | Content | 7210 | Information | Symantec Endpoint Protection Manager | LiveUpdate session started.
SEPM | Content | 7211 | Information | Symantec Endpoint Protection Manager | LiveUpdate session completed. Total elapsed time: [ ]minutes.

The content message text field contains the following subfields, in addition to the message text prefix that is specific to each eventID. Only the relevant subfields are written to the message text. For example, the source is written only to events that log download success or failure.

Table: Content message text details

Subfield label | Subfield description
--- | ---
Product | Symantec product (content type) registered with LiveUpdate.
Version | The version number of the content type specified in the Product subfield.
Language | The language in which the specified content type is published.
Monikers | Server monikers, comma-separated
Sequence | Raw revision sequence
PublishDate | The date that this content type was published, in UTC complete date format.
Revision | [int]
Size (in bytes) | The size of the content package, in bytes (per content type)
Source | The source from which the management server downloaded the specified content type (ENUM). Options are: 1 = publicLU Public (Symantec) LiveUpdate server 2 = privateLU LiveUpdate server installed on a customer's internal network. This type of LiveUpdate server is configured by using the LiveUpdate Administration utility.