#MessageID,Type,SEV-CODE,RULE-VALUE,Disposition,"Operation","Message"

10000,MCON,C,90,F,"Local Configuration Operation","Configuration File Name empty"

10001,MCON,W,59,F,"Local Configuration Operation","Failed to open configuration
file. Cannot open file '%s'. Error code : %d."
10002,MCON,I,12,F,"Local Configuration Operation","Unrecognized configuration item
%s"
10003,MCON,W,40,F,"Local Configuration Operation","Failed to remove old
configuration file"
10004,MCON,C,90,F,"Local Configuration Operation","Failed to save configuration
file"
10005,MCON,N,39,F,"Local Configuration Operation","Failed to create file %s. Error
Code %d"
10006,MCON,C,90,F,"Local Configuration Operation","Failed to save configuration
file %s"
10007,MCON,N,39,F,"Local Configuration Operation","Invalid Data Exception %s"
10008,MCON,N,20,S,"Local Configuration Operation","Successfully read from the
fallback agent file"
10009,MCON,W,59,F,"Local Configuration Operation","Unable to read from the
agent.ini"

10100,MSTA,I,19,F,"Registration","Not Retrying Registration error code %d -- error

string %s"
10101,MSTA,W,59,F,"HIDS Interfacing Operation","Error getting IDS Attributes %s"
10102,MSTA,W,59,F,"Registration","Unsuccessful Registration -- %s"
10103,MSTA,I,19,S,"Registration","Successfully Registered Agent"
10104,MSTA,I,12,F,"Protection","Driver is using the builtin policy and not the
assigned policy."
10105,MSTA,I,12,S,"Rollover","Rolling over Driver Log file."
10106,MSTA,I,19,S,"Startup","Starting Symantec Data Center Security Server Service
%s"
10107,MSTA,C,90,F,"Shutdown","Agent Exiting"
10108,MSTA,I,12,S,"Rollover","Rolled over Agent Log file from '%s' to '%s'"
10109,MSTA,I,12,S,"Shutdown","Symantec Data Center Security Server Service shutting
down"
10110,MSTA,I,12,S,"Shutdown","Symantec Data Center Security Server Service shutdown
complete"
10111,MSTA,W,50,F,"Internal Operation","Caught exception... continuing %s"
10112,MSTA,C,90,F,"Driver Interace Operation","Failed to get handle to driver, %lu"
10113,MSTA,C,90,F,"Driver Interace Operation","Failed to open driver, %d"
10114,MSTA,C,90,F,"Driver Interace Operation","Access denied."
10115,MSTA,C,90,F,"Driver Interace Operation","ioctl(%d) failed, errno=%d"
10116,MSTA,C,90,F,"Driver Interace Operation","Could not open event"
10117,MSTA,C,90,F,"Driver Interace Operation","Wait abandoned"
10118,MSTA,W,59,F,"Driver Interace Operation","took too long!"
10119,MSTA,W,59,F,"Driver Interace Operation","I/O failed, %lu"
10120,MSTA,N,20,F,"Translation","Policy Retranslation failed : %s"
10121,MSTA,N,20,S,"Translation","Applied retranslated policy %s"
10122,MSTA,W,50,F,"HIDS Interfacing Operation","processConfigPolicyUpdates : Error
while getting HIDS HeartBeat %s"
10123,MSTA,W,50,F,"Local Configuration Operation","Failed to save new configuration
data from server to disk"
10124,MSTA,I,19,S,"Configuration Update","Successfully applied the IPS
Configuration"
10125,MSTA,I,19,S,"Configuration Update","Successfully updated the policy to %s"
10126,MSTA,W,59,F,"Local Configuration Operation","Failed to open Update Results
file: %s"
10126,MSTA,I,19,S,"Software Update","Software Update %s was successful"
10127,MSTA,W,40,F,"Software Update","Failed to cleanup: %s"
10128,MSTA,W,40,F,"Translation","Failed to load translation items"
10129,MSTA,W,40,F,"Translation","Couldn't parse translation item: %s"
10130,MSTA,N,30,F,"Translation","Error in getFunctionValues"
10131,MSTA,C,90,S,"Disk Monitoring","Used Disk Space greater than %d%%. Driver
logging stopped."
10132,MSTA,I,19,S,"Disk Monitoring","Used Disk Space less than %d%%. Driver logging
resumed."
10133,MSTA,C,90,F,"Translation","Policy Translation Failed: %s"
10134,MSTA,I,12,S,"Rollover","Rolling over Profile Log file"
10135,MSTA,N,30,F,"Internal Error","Internal Error %s"
10136,MSTA,C,80,F,"LogProcessing","Shutting down %s. Exception %s"
10137,MSTA,W,59,F,"Translation","Cannot rename %s to %s. Error Code %d"
10138,MSTA,W,59,F,"Policy Update","HIDS Policy Application failed. %s"
10140,MSTA,W,59,F,"Translation","Cannot create %s. Error Code %d"
10141,MSTA,W,59,F,"Configuration Update","Error while sending configuration to IDS
Service: %s"
10142,MSTA,I,10,S,"Configuration Update","Successfully applied the IDS
Configuration"
10143,MSTA,N,20,F,"Log Cleanup","Could not remove log file %s"
10144,MSTA,I,19,S,"Bulk Log Transfer","Uploaded the log file %s to the server"
10145,MSTA,N,39,S,"Log Cleanup","Deleted log file %s"
10146,MSTA,N,20,F,"Manifest Generation","Could not create Manifest file %s"
10147,MSTA,N,20,F,"PostRealTimeProcessing","Post Real Time Log Processing failed
%s"
10329,MSTA,C,12,F,"LogProcessing","Local event cache file SISRTEventsX.csv was
compromised, either truncated or removed. Some events were lost."
#This event (10148) is an internal event ... do not modify its 'Message' field
10148,MREP,I,10,S,"Catalog Event Generation","%s"
10149,MSTA,N,20,F,"General Operation","Invalid integer value %s"
10150,MSTA,N,20,F,"HIDS Configuration Update","Failed to apply the configuration.
Error Code %s. Error Description %s"
10151,MSTA,W,50,F,"Configuration","Could not find IDS policy file %s"
10152,MSTA,N,35,F,"Bulk Log Transfer","Error while uploading file %s to server.
Error Code : %d"
10153,MOVR,M,60,S,"PolicyMonitor","Policy Override: %s has disabled prevention."
10154,MOVR,I,10,S,"PolicyMonitor","Policy Override: %s has re-enabled prevention."
10155,MOVR,W,50,F,"PolicyMonitor","Unable to open util service port."
10156,MOVR,W,45,F,"PolicyMonitor","Policy Override: Failed to re-enable prevention
after time expired."
10157,MOVR,W,45,F,"PolicyMonitor","Policy Override: Ended override after time
expired, but encountered an error when trying to retranslate policy."
10158,MOVR,N,20,S,"PolicyMonitor","Policy Override: Ended override after time
expired, but agent is using builtin policy so prevention is not enabled."
10159,MOVR,W,45,F,"PolicyMonitor","Policy Override: Ended override after time
expired, but prevention did not become enabled."
10160,MOVR,I,10,S,"PolicyMonitor","Policy Override: Re-enabled prevention after
time expired."
10161,MSTA,I,10,S,"Policy Retranslation","Policy Retranslation Triggered. Reason :
%s"
10162,MSTA,C,80,F,"Bulk Log Tranfer","Fatal Error while trying to upload file %s.
Hence skipping the file."
10163,MSTA,C,80,F,"File Completion Processing","Fatal Error while trying to open
file %s, error code %d."
10164,MSTA,C,80,F,"Log Cleanup","Could not move log file %s to archive directory."
10165,MSTA,N,20,F,"PostRealTimeProcessing","Failed to zip file %s during File
Completion processing."
10166,MSTA,I,12,S,"Protection","Driver is no longer using the builtin policy and is
using the previously assigned policy."
10167,MSTA,N,20,S,"Startup","Management Server URL : %s"
10168,MSTA,N,30,S,"Failover","Successful failover from Server %s to Server %s"
10169,MSTA,N,30,S,"Failover","Successful failback from Server %s to the Primary
Server %s"
10170,MOVR,I,10,S,"PolicyMonitor","Policy Override: Override Time Extended by %s
for %s seconds."
10171,MOVR,I,10,S,"InstallOverride","Install Override: System configured for
privilege escalation on next reboot."
10172,MOVR,W,45,S,"InstallOverride","Install Override: Auto-start programs given
Safe privilege for installation purposes."
10173,MOVR,C,80,F,"InstallOverride","Install Override: Unable to give auto-start
programs Safe privilege. Installation tasks may fail."
10174,MOVR,W,45,S,"InstallOverride","Install Override: Auto-start programs reset to
Standard privilege."
10175,MOVR,C,80,F,"InstallOverride","Install Override: Unable to reset Explorer to
Standard privilege. Users may have undefined privileges."
10176,MSTA,C,80,F,"LogProcessing","Failed to open file pointer file %s. Error code
%d."
10177,MSTA,I,10,S,"ApplicationDataRetrieval","System Application Data Scan
completed successfully."
10178,MSTA,C,80,F,"ApplicationDataRetrieval","System Application Data Scan failed.
Error: %s."
10179,MSTA,I,10,S,"Component LiveUpdate","Component LiveUpdate completed
successfully."
10180,MSTA,C,80,F,"Component LiveUpdate","Component LiveUpdate failed."
10181,MSTA,I,19,S,"Startup","Oval engine started"
10182,MSTA,I,19,S,"Shutdown","Oval engine successfully finished"
10183,MSTA,I,19,S,"Shutdown","Oval engine failed Error : %d"
10184,MSTA,I,19,S,"Shutdown","Oval engine failed Error : %S"
10185,MSTA,C,80,F,"SISRTEvent.csv", "Fatal Error: No Event going to sever. Event
log file not initialized."
10186,MSTA,I,10,S,"ApplicationDataRetrieval","System Application Data Scan
started."

10201,MCOM,N,20,F,"Translation","Could not get list of IP's"

10202,MCOM,N,20,F,"Local Network Interface","Reinitializing curl"
10203,MCOM,W,50,F,"Commmunication Protocol","::getConfiguration Did not get back
update property"
10204,MCOM,W,50,F,"Commmunication Protocol","::getConfiguration Did not get back
Mod Time property"
10205,MCOM,W,50,F,"Commmunication Protocol","Server did not return any property
section"
10206,MCOM,W,50,F,"Commmunication Protocol","Client asking for the wrong update"
10207,MCOM,W,50,F,"Commmunication Protocol","Server did not return any property
section"
10208,MCOM,W,50,F,"Commmunication Protocol","Did not get back update property"
10209,MCOM,W,50,F,"Commmunication Protocol","Did not get back RID APPLIED property"
10210,MCOM,W,50,F,"Commmunication Protocol","Did not get back RID GROUP property"
10211,MCOM,W,50,F,"Commmunication Protocol","Did not get back POLICY NAME property"
10212,MCOM,W,50,F,"Commmunication Protocol","Did not get back POLICY PATH property"
10212,MCOM,W,50,F,"Commmunication Protocol","Server did not send a policy"
10213,MCOM,W,50,F,"Communication","SDCSS Error when trying to send a log. Error
Code %d : Error Message : %s"
10214,MCOM,I,19,S,"Communication","Successfully sent log to server"
### Events 10215 and 10216 are no longer being logged:
#,#,# 10215,MCOM,W,50,F,"Notification","Failed to read notification message"
#,#,# 10216,MCOM,W,50,F,"Notification","Got invalid notification message, byte is
0x%x"
10217,MCOM,W,50,F,"Communication","::processUpdates() Error Message : %s. Error
Code %d"
10218,MCOM,W,50,F,"Communication","processSoftwareUpdate() Error Message : %s.
Error Code %d"
10219,MCOM,N,20,S,"Communication","Successful Communication with server %s"
10220,MCOM,W,50,F,"Commmunication Protocol","Server did not send the software"
10221,MCOM,W,50,F,"Commmunication Protocol","Internal Error : %s"
10222,MCOM,W,50,F,"Commmunication Protocol","HTTP Error: %s"
10223,MCOM,W,50,F,"Communication","Curl Error: %s."
10224,MCOM,W,50,F,"Communication","curl_easy_init NULL"
10225,MCOM,W,50,F,"Communication","curl_easy_init NULL in reInitializeCurl"
10226,MCOM,W,50,F,"Communication","processHIDSPolicyUpdate() Error Message : %s.
Error Code %d"
10227,MCOM,N,20,F,"Communication","SDCSS FATAL Database Error when trying to send a
log. Error Code %d : Error Message : %s"
10228,MCOM,C,90,F,"Notification","Could not create socket for notification port,
error %d."
10229,MCOM,C,90,F,"Notification","Could not bind to notification port %d, error
%d."
10230,MCOM,C,90,F,"Notification","Could not listen on notification port %d, error
%d."
10231,MCOM,W,50,F,"Commmunication","LiveUpdate content from server is empty for
'%s'"
10232,MCOM,W,50,F,"Commmunication","Server responded with error message: %s. Error
Code %d"

10240,MCOM,W,50,F,"Commmunication Protocol","::GetStartScanRequest did not get back

update properly"
10241,MCOM,W,50,F,"Commmunication Protocol","::GetStartScanRequest Server did not
return any property section"

10242,MCOM,W,50,F,"Commmunication Protocol","::GetStartScanRequest did not get back

update properly"
10243,MCOM,W,50,F,"Commmunication Protocol","::GetStartScanRequest Server did not
return any property section"

# SISIPS Config Tool messages

10300,MSTA,I,10,S,"AgentConfigTool","Set configuration item: %s=%s"
10301,MSTA,I,19,F,"AgentConfigTool","Failed attempt to set configuration item: %s=
%s"
10302,MSTA,I,15,S,"AgentConfigTool","Cleared agent unique ID to force
reregistration."
10303,MSTA,C,80,S,"AgentConfigTool","Successfully reset policy to builtin."
10304,MSTA,I,19,F,"AgentConfigTool","Failed to reset policy to builtin."
10305,MSTA,I,10,S,"AgentConfigTool","Flagged IPS Service log file for rollover."
10306,MSTA,I,10,S,"AgentConfigTool","Flagged Event file for rollover."
10307,MSTA,I,19,F,"AgentConfigTool","Flagged Event file for rollover but could not
signal the IDS Service."
10308,MSTA,I,19,F,"AgentConfigTool","Attempt to flag Event file for rollover
failed: the IDS Service is busy or has pending updates."
10309,MSTA,I,19,F,"AgentConfigTool","Attempt to flag Event file for rollover
failed: the IDS Service is not present."
10310,MSTA,I,10,S,"AgentConfigTool","Tracing turned on."
10311,MSTA,I,10,S,"AgentConfigTool","Tracing turned off."
10312,MSTA,I,10,S,"AgentConfigTool","Requested forced retranslation."
10313,MSTA,I,19,F,"AgentConfigTool","Prevention feature is not supported on this
platform. No action was performed."
10314,MSTA,W,19,F,"AgentConfigTool","Attempt to enable the prevention feature
failed: prevention not supported on this platform."
10315,MSTA,W,19,F,"AgentConfigTool","Attempt to disable the prevention feature
failed: unable to update registry."
10316,MSTA,W,19,F,"AgentConfigTool","Attempt to enable the prevention feature
failed: unable to update registry."
10317,MSTA,I,15,S,"AgentConfigTool","Prevention feature disabled."
10318,MSTA,I,10,S,"AgentConfigTool","Prevention feature enabled."
10319,MSTA,I,12,S,"AgentConfigTool","Prevention feature disabled. Will take effect
at next boot."
10320,MSTA,I,10,S,"AgentConfigTool","Prevention feature enabled. Will take effect
at next boot."
10321,MSTA,I,10,S,"AgentConfigTool","Successfully set policy to most recent applied
policy."
10322,MSTA,C,80,F,"AgentConfigTool","Failed to set policy to most recent applied
policy."
10323,MSTA,I,12,S,"AgentConfigTool","Prevention feature already disabled. No action
was taken."
10324,MSTA,I,12,S,"AgentConfigTool","Prevention feature already enabled. No action
was taken."
10325,MSTA,I,15,S,"AgentConfigTool","Antimalware protection feature disabled. Will
take effect on next boot."
10326,MSTA,I,15,S,"AgentConfigTool","Antimalware protection feature enabled. Will
take effect on next boot."
10327,MSTA,I,15,S,"AgentConfigTool","Antimalware protection feature already
disabled. Reboot Pending. Will take effect on next boot."
10328,MSTA,I,15,S,"AgentConfigTool","Antimalware protection feature already
enabled. Reboot Pending. Will take effect on next boot."
10329,MSTA,I,12,S,"AgentConfigTool","Antimalware auto-protect (AP) feature already
disabled. No action was taken."
10330,MSTA,I,12,S,"AgentConfigTool","Antimalware auto-protect (AP) feature already
enabled. No action was taken."
10331,MSTA,I,15,S,"AgentConfigTool","Antimalware auto-protect (AP) feature
disabled."
10332,MSTA,I,15,S,"AgentConfigTool","Antimalware auto-protect (AP) feature
enabled."
10333,MSTA,I,12,S,"AgentConfigTool","Antimalware protection feature already
disabled. No action was taken."
10334,MSTA,I,12,S,"AgentConfigTool","Antimalware protection feature already
enabled. No action was taken."
10335,MSTA,I,12,S,"AgentConfigTool","Antimalware protection feature event profiling
enabled"

# ---- Config Tool Edit Option Messages

10360,MSTA,I,10,S,"ConfigToolEdit","Configtool Edit of file %s Successful.
Arguments: -%s"
10361,MSTA,C,80,F,"ConfigToolEdit","Failed to Edit file %s. Error = %s. Arguments:
-%s"
10503,MSTA,I,12,S,"AgentConfigTool","FIPS Enabled"
10504,MSTA,I,12,S,"AgentConfigTool","FIPS Disabled"

#Driver Interface Messages

10400,MSTA,C,90,S,"Driver Interace Operation","Failure Cleared. Able to get handle
to driver"
10401,MSTA,C,90,S,"Driver Interace Operation","Failure Cleared. Able to open/access
driver"

#RTFIM Messages
10440,MSTA,I,12,S,"AgentConfigTool","RealTime FIM feature disabled. Will take
effect at next boot."
10441,MSTA,I,10,S,"AgentConfigTool","RealTime FIM feature enabled. Will take effect
at next boot."
#SISIPS Utility Service Messages
10500,MSTA,I,19,S,"Startup","Starting Symantec IPS Utility Service"
10501,MSTA,I,12,S,"Shutdown","Stopping Symantec IPS Utility Service"
10502,MSTA,W,19,F,"Startup","Failed to start Symantec IPS Utility Service. Err: %s"

#Content Manager LU Messages

10600,MSTA,C,23,F,"Component LiveUpdate","LiveUpdate server selection failed: %s"
10601,MSTA,C,23,F,"Component LiveUpdate","LiveUpdate session failed. Error: %s"

#Anti-malware Error/status messages

10700,MSTA,I,25,S,"Anti-malware","Command status: %s"
10701,MSTA,I,35,F,"Anti-malware","Command status: %s"

10705,MSTA,I,25,S,"Anti-malware","Scan status: %s"