## Client events

The following events are logged on the client and supported in this release of Symantec Endpoint Protection. They are written to a custom target log for easier management (log retention, configuration, etc).

Note: | The first 17 events in this list (marked with an asterisk, *) are also logged in the Application Target Log, Event Source Symantec AntiVirus, for backward compatibility with earlier versions of the product. The only exceptions are events 13 and 14, which are logged to the application log only. We recommend that you monitor services directly. See Services running on the client and the server.

Table:

Event Source | Category | EventID | Type | Target Log | Message Text
--- | --- | --- | --- | --- | ---
Symantec Endpoint Protection Client | None | 2* | Information | Symantec Endpoint Protection Client | Scan Complete: [scan details].
Symantec Endpoint Protection Client | None | 3* | Information | Symantec Endpoint Protection Client | Scan started on [scan details determined by policy].
Symantec Endpoint Protection Client | None | 7* | Information | Symantec Endpoint Protection Client | New virus definition file loaded. Version: [version number] Previous virus definition file loaded. Version: [version number]
Symantec Endpoint Protection Client | None | 13 | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection services shutdown was successful. (Application log only)
Symantec Endpoint Protection Client | None | 14 | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection services startup was successful. (Application log only)
Symantec Endpoint Protection Client | None | 21* | Information | Symantec Endpoint Protection Client | Scan Failure: [details of error encountered].
Symantec Endpoint Protection Client | None | 22* | Warning | Symantec Endpoint Protection Client | Occurs when Auto-Protect fails to load.
Symantec Endpoint Protection Client | None | 23* | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection Auto-Protect Enabled.
Symantec Endpoint Protection Client | None | 24* | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection Auto-Protect Disabled.
Symantec Endpoint Protection Client | None | 40* | Error | Symantec Endpoint Protection Client | Occurs when a computer is not protected with definitions.
Symantec Endpoint Protection Client | None | 45* | Information | Symantec Endpoint Protection Client | SYMANTEC TAMPER PROTECTION ALERT Target: [details], Event Info: [details], ActionTaken: [details], Actor Process [details], Time: [timestamp].
Note: | This event was logged with type Error in earlier versions of Symantec Endpoint Protection.
Symantec Endpoint Protection Client | None | 51* | Error | Symantec Endpoint Protection Client | [threat detected] [threat details] [protection technology that found the threat: Auto-Protect (includes Download Insight) or SONAR] [action taken on the threat] [action succeeded or failed] [additional threat details]
Symantec Endpoint Protection Client | None | 34053* | Information | Symantec Endpoint Protection Client | Proactive Threat Protection (SONAR) is disabled.
Symantec Endpoint Protection Client | None | 34054* | Information | Symantec Endpoint Protection Client | SONAR has been enabled.
Symantec Endpoint Protection Client | Connectivity | 100 | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection is online and reporting to the management server.
Symantec Endpoint Protection Client | Connectivity | 101 | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection cannot communicate with the management server.
Symantec Endpoint Protection Client | Connectivity | 102 | Information | Symantec Endpoint Protection Client | Symantec Endpoint Protection client is self-managed.
Symantec Endpoint Protection Client | Content | 200 | Information | Symantec Endpoint Protection Client | [prefix:] Updated content was successfully downloaded. [details:] See Table: Content message text details.
Symantec Endpoint Protection Client | Content | 201 | Information | Symantec Endpoint Protection Client | [prefix:] Updated content could not be downloaded. [details:] See Table: Content message text details.
Symantec Endpoint Protection Client | Content | 202 | Information | Symantec Endpoint Protection Client | [prefix:] Updated content was successfully installed. [details:] See Table: Content message text details.
Symantec Endpoint Protection Client | Content | 203 | Warning | Symantec Endpoint Protection Client | [prefix:] Updated content could not be installed. [details:] See Table: Content message text details.

The content message text field contains the following subfields, in addition to the message text prefix that is specific to each eventID. Only the relevant subfields are written to the message text. For example, the source is written only to events that log download success or failure.

Table: Content message text details

Subfield label | Subfield description
--- | ---
Product | Symantec product (content type) registered with LiveUpdate.
Note: | This is the subfield that you must monitor to determine whether content is up to date on the server.
Version | The version number of the content type specified in the Product subfield.
Language | The language in which the specified content type is published.
Monikers | Server monikers, comma-separated
Sequence | Raw revision sequence
PublishDate | The date that this content type was published, in UTC complete date format.
Revision | [int]
Size (in bytes) | The size of the content package, in bytes (per content type)
Source | The source from which the client downloaded the specified content type (ENUM). Options are: 1 = publicLU Public (Symantec) LiveUpdate server 2 = privateLU LiveUpdate server installed on a customer's internal network. This type of LiveUpdate server is configured by using the LiveUpdate Administration utility. 3 = localInstall Direct drop of content update (definitions) file (.vdb or .jdb) onto the client 4 = SEPServer The management server, if it is configured to provide updated content to its clients 5 = GUP A Group Update Provider (GUP) is a client that is designated to provide updates to other clients in a local network.