## Licensing events

The following events are written to the Windows Event Log on the Symantec Endpoint Protection management server.

Note: | EventIDs 7103 and 7113 (out of compliance with licenseing requirements) are written in the case of any expired license type: purchased, trial, or upgrade. These events are also written in the case where a current license is deleted on the Symantec Endpoint Protection management server. Any scripts written to monitor licensing status should therefore examine the timestamp of the event first, not the eventID.

See About Symantec Endpoint Protection licensing.

See Monitoring license state on the management server.

Table:

Event Source | Category | EventID | Type | Target Log | Message Text
--- | --- | --- | --- | --- | ---
SEPM | Licensing | 7100 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Endpoint Protection is in compliance with the license requirements. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7101 | Warning | Symantec Endpoint Protection Manager | [prefix:] Symantec Endpoint Protection license is about to expire. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7103 | Error | Symantec Endpoint Protection Manager | [prefix:] Symantec Endpoint Protection is out of compliance with the license requirements. The total number of seats in use exceeds the number of current licensed seats. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7104 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Endpoint Protection trial license is installed. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7105 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Endpoint Protection upgrade license is installed. [details:] See Table: Licensing message text details.

Table:

Event Source | Category | EventID | Type | Target Log | Message Text
--- | --- | --- | --- | --- | ---
SEPM | Licensing | 7110 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Network Access Control is in compliance with the license requirements. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7111 | Warning | Symantec Endpoint Protection Manager | [prefix:] Symantec Network Access Control license is about to expire. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7113 | Error | Symantec Endpoint Protection Manager | [prefix:] Symantec Network Access Control is out of compliance with the license requirements. The total number of seats in use exceeds the number of current licensed seats. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7114 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Network Access Control trial license is installed. [details:] See Table: Licensing message text details.
SEPM | Licensing | 7115 | Information | Symantec Endpoint Protection Manager | [prefix:] Symantec Network Access Control upgrade license is installed. [details:] See Table: Licensing message text details.

The licensing message text field contains the following subfields, in addition to the message text prefix that is specific to each eventID.

Table: Licensing message text details

Subfield label | Subfield description
--- | ---
Total licensed seats: | The total number of available seats in all licenses.
Total seats used: | The total number of used seats in all licenses.
License type: | ENUM. 0 = Purchased (per license), 1 = Trial, 2 = Upgrade
Note: | This subfield and the following two subfields repeat for each license.
Seats in this license: | The number of seats in the license specified by the license type subfield. For trial and upgrade licenses, this value is always Unlimited, even though the license may have expired. In the case of expired trial or upgrade licenses, the Total licensed seats field displays 0.
Expiration date for this license: | The expiration date for this license, in UTC complete date format.