W Explanation of Event Log Codes

This appendix explains the messages that are reported in the Event Log. The use of the Event Log is explained in Section 15.7, "Working with the Event Log".

Table W-1 Explanation of Event Log Messages

Code	Message	Explanation
10000	Collector started successfully	The Collector was started successfully by the system.
10001	Collector exited normally	The Collector exited on a scheduled condition (for instance, because it needs to apply configuration setting changes).
10002	Collector exited, initialization failed	The Collector exited during start up because of an unrecoverable configuration error.
10003	Collector out of memory	The Collector's memory usage exceeded the configured threshold.
10004	Collector exited for other reason	The Collector exited unexpectedly due to an unknown reason.
10005	Collector exited on segmentation fault	The Collector exited unexpectedly due to a program crash.
10010	Collector started by watchdog	The Collector was started by the watchdog process. This is most likely due to it having previously exited unexpectedly.
10011	Collector stopped by watchdog	The Collector was stopped by the watchdog process due to an error condition (for instance, the program ran out of memory or was hanging). The actual error is reported separately.
10020	No interfaces suitable for traffic collection found	The Collector cannot start because it cannot find a network interface that can be used for monitoring data. Typically, that is because the interface has an IP address.
10030	Primary system unreachable: activating standby	In a high-availability environment, the primary system has just became unreachable. The failover system will now become active and take over.
10031	Standby system unreachable	In a high-availability environment, the failover system has just became unreachable.
10050	Configuration changes activated	Any pending configuration changes have been successfully applied.
10051	Traffic filter changes activated	Configuration changes related to network traffic filters have been successfully applied.
10052	Masking changes activated	Configuration changes related to data masking have been successfully applied.
10053	Content scan changes activated	Configuration changes related to content (for instance, error strings and page-naming based on HTML Title) have been successfully applied.
10054	App/Suite/Service definition changes activated	Configuration changes related to any application, service, or suite definition have been successfully applied.
10055	Oracle Forms changes activated	Configuration changes related to Oracle Forms have been successfully applied.
10056	Replay storage settings changes activated	Configuration changes related to the size of the Replay data storage have been successfully applied.
10060	Configuration changes trigger Collector restart	The latest set of configuration changes require a Collector restart. This will be scheduled and executed by the system.
10061	Traffic filter changes activated	Configuration changes related to traffic filtering have been successfully applied.
10066	Replay storage settings changes trigger Collector restart	Configuration changes related to the size of the replay data storage required a restart of the Collector.
10100	Content scan syntax error	An internal sysntax error related to content scan pattern matching has occured.
10101	Content scan of %1$s KB does not fit in %2$s KB memory limit	A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request.
10102	Content scan of %1$s KB does not fit in %2$s KB free content scan memory	A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request.
10103	Content scan of %s KB does not fit in global memory limit	A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request.
10104	Content scan loaded	Informational message indicating the collector received and successfully applied new content scan configuration.
10110	Failed to move log file to final name '%s'	The temporary HTTP log file used for the current logging period could not be moved to its final location on disk. Typically, this is due to a write/access permission problem or a missing directory component in the path.
10111	Failed to open new HTTP log file '%s'	The Collector tried and failed to open a new HTTP log file for the next logging period. Typically, this is due to a write/access problem or a missing component in the directory path.
10112	No HTTP/Forms ports configured.	Informational message indicating no port configuration is found for HTTP/Forms. This is configured in Configuration > Security > protocols.
10200	Collector exceeded %1$s KB memory limit by %2$s KB	The Collector operates under a memory limit which is used to prevent it from consuming too much memory which may lead to a deterioration in the system's operation. This message indicates that the Collector exceeded the currently configured memory limit. Whenever this condition is detected, this message is reported and the Collector exits.
10201	Collector approaching %1$s KB memory limit at %2$s KB	The Collector operates under a memory limit which is used to prevent it from consuming too much memory which may lead to a deterioration in the system's operation. This message is a warning that the current memory used by the Collector is approaching the configured limit.
10300	At hit time %1$s: POST variable truncated at %2$s bytes: %3$s	The content of a POST message is buffered by the Collector during processing. This message is reported whenever a message exceeds the current internal buffer limit.
10301	POST request truncated at %1$s of %2$s total bytes	The content of a POST message is buffered by the Collector during processing. This message is reported whenever a message exceeds the current internal buffer limit.
10400	Thread npa%1$s: no heartbeat seen. Restarting Collector	A traffic processing thread in the Collector has locked up, probably due to an internal error. The Collector must be restarted in order to reset the thread.
10500	Collector receiving too much traffic; dropping new connections to reduce load	The Collector allocates memory that is used for processing traffic and queueing network packets while awaiting processing. When too much traffic is received, the queues can grow out of control. To prevent this, the Collector starts dropping any new TCP sessions. Note that existing sessions are still processed in order to manage the queues.
10501	Collector receiving too much traffic; dropping all new data to reduce load	The reduction of traffic load by dropping new TCP sessions did not alleviate the queue overload. To avoid running out of memory, the Collector will stop processing any new data, and will only process the packets currently in the queues.
10502	Collector load under threshold; resuming normal data collection	The packet queues have been drained sufficiently. The Collector is now ready to process all traffic again.
10601	Dropping HTTP header %s: too many headers	This message is reported whenever the number of configured custom headers in the Collector exceeds 64. Custom headers are generated by all RUEI configuration items that take their input from an HTTP header field (such as user IDs, custom dimensions, and website errors).
10700	Collector encountered frames upto %1$s bytes; suggested maximum frame size setting	This message is reported whenever the collector encounters a packet that is larger is size then the current configured frame size. Action: Configure the frame size to the suggested value. This is done in Configuration > Security > Jumbo Frames
19998	Internal error (%s).	This message reports that a generic internal error occurred.
19999	%s	This message reports that a generic internal error occurred.
20000	Message threshold (%1$s) exceeded	The number of messages that a single process can generate in a short time is limited. This message indicates that the limit has been reached, and that no further messages are logged for the process.
20001	Job exited with exit code %1$s (%2$s)	A processing job failed (generic message).
20002	Collector %1$s at %2$s is unreachable	Reported when an SSH connection to the Collector to fetch its HTTP log files could not be made.
20003	Rsync of %1$s failed with exit code %2$s (%3$s)	The fetching of HTTP log files from the Collector failed.
20004	Cannot connect to database	One of the jobs could not make a database connection.
20005	Cannot open file %1$s for reading	A system file could not be opened (generic message).
20006	Cannot open file %1$s for writing	A system file could be written (generic message).
20007	Database usage is less than the alert threshold (%1$s%%)	Database usage has returned to a level below the configured alert threshold.
20008	Database usage exceeds the current alert threshold (%1$s%%)	The configured alert database usage threshold has been exceeded. It is recommended that you review the database's maximum size.
20009	Database usage exceeds the current stop threshold (%1$s%%); data processing on hold	The configured maximum database usage threshold has been exceeded. No further data will be written to the database until an administration mechanism has brought the database's size back to within its permitted boundary.
20010	Disk usage is less than the alert threshold (%1$s%%)	Disk space usage has returned to a level below the configured alert threshold.
20011	Disk usage exceeds the current alert threshold (%1$s%%)	The configured alert disk usage threshold has been exceeded. It is recommended that you review the system's disk space availability.
20012	Disk usage exceeds the current stop threshold (%1$s%%)	The configured maximum disk usage threshold has been exceeded. No further data will be written to the file system until an administration mechanism has brought the disk usage back to within its permitted boundary.
20020	Rsync of %1$s still failing after %2$s hours with exit code %3$s (%4$s)	Same as 20003. Repeated every hour while rsyncing log files from a Collector fails.
20021	Still cannot connect to database after %1$s hours	Same as 20004. Repeated every hour while connecting to the database fails.
20022	Collector %1$s at %2$s still unreachable after %3$s hours	Same as 20002. Repeated every hour while the SSH connection to a Collector fails.
20030	Thread deadlock detected in the log file processor; forcing a core dump	An internal error occurred in the processing of log files. Data processing is affected, and reporting may be inaccurate.
20031	Job scheduler started	Informational message.
20032	Log file processor used more than %1$s% of total memory (%2$s MB)	The log file processor's memory limit has been reached, and it exited. Although it is automatically restarted, action should be taken to increase the amount of the system's physical memory.
20033	Content masking information not uploaded to Collector %1$s at %2$s.	Warning message that configuration changes related to masking where not uploaded to the collector successfully. Suggested action is to make an additional masking change in order to force a new update to the collector.
20034	Forms information not uploaded to Collector %1$s at %2$s.	Warning message that configuration changes related to EBS Forms where not uploaded to the collector successfully. Suggested action is to make an additional EBS Forms change in order to force a new update to the collector.
20035	Invalid event log file: %1$s	A data file was found to be corrupt. One minute of data has been lost.
20036	Content scan configuration not uploaded to Collector %1$s at %2$s	Warning message that configuration changes related to content scanning where not uploaded to the collector successfully. Suggested action is to make an additional content scan change in order to force a new update to the collector.
20037	Which headers to report not uploaded to Collector %1$s at %2$s	Warning message that configuration changes related to HTTP headers capture where not uploaded to the collector successfully. Suggested action is to make an additional HTTP header capture change in order to force a new update to the collector.
20038	Command exited with signal %1$s (%2$s)	A system job exited with an error.
20039	Connecting to database timed out after %1$s minutes	A database connection could not be made, even after repeated attempts during the indicated period.
20040	Data processing could not keep up with the amount of traffic measured	Reported when not all the processing jobs could be completed within a 5-minute period. May indicate that the system is overloaded. Should be ignored if it occurs infrequently.
20041	There have not been new log files in %1$s minutes	Indicates that no Collector log files arrived at the Processing Engine.
20044	Log file processing started	Informational message.
20045	Log file processing stopped with exit status %1$s	There was an error that interrupted log file processing. It will be restarted automatically.
20046	Core dump of log file processor	Log file processor has crashed. It will be restarted automatically.
20047	Log file processing stopped (missing parent process)	The log file processing stopped because of an internal error. It will be restarted automatically.
20048	Log file processor initialization failed	Log file processing cannot start due to an internal error. It is strongly recommended that you contact Customer Support.
20049	Log file processor reinitialization failed. Restarting	Log file processing restarted due to an internal error.
20050	Configuration update failed	A configuration change could not be applied due to an internal error.
20051	Command exited with exit status %1$s	A system job failed.
20052	Application matching information not uploaded to Collector %1$s at %2$s	Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20053	Hit-type matching information not uploaded to Collector %1$s at %2$s	Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20054	HTTP webdav enable information not uploaded to Collector %1$s at %2$s	Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20055	HTTP proxy header information not uploaded to Collector %1$s at %2$s	Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20056	Cannot connect to database; will retry	Connection to the database failed. It will be re-attempted automatically.
20057	Uploading of configuration to Collector %1$s at %2$s failed	A configuration change could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20058	Uploading of configuration to Collector %1$s at %2$s timed out; retrying	A configuration change could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems.
20059	Connected to database after %1$s attempts	Connection to the database previously failed, but has now succeeded.
20060	Requested reboot for instance %1$s not necessary, config already up-to-date	A previously scheduled Collector restart has been determined to be no longer necessary.
20061	Failover: the primary Reporter is down; triggered failover to standby Reporter (host=%1$s)	In a high-availability setup, the primary Reporter system failed and the failover Reporter system took over.
20062	Failover: primary Reporter (host=%1$s): the standby Reporter seems to be down	In a high-availability setup, the primary Reporter system detected that the failover Reporter system is no longer reachable.
20063	More than %1$s cookies defined: ignoring cookie %2$s	The limit on the number of configurable session cookies has been reached. It is recommended that you review your session tracking configuration settings.
20064	Connected to database after some attempts	Previous attempts to connect to the database failed, but connection has now succeeded.
29006	Backup created	A RUEI system configuration backup was created.
29007	Backup restored	A RUEI system backup was restored.
29008	System reset to factory defaults	The Reset to factory defaults option was selected from the System reset wizard.
29009	Data purged	The Purge collected data option was selected from the System reset wizard.
29010	System processing restarted	The Restart system processing option was selected from the System reset wizard.
29011	Force a reconfiguration to solve the problem	You need to select the Reapply latest configuration option from the System reset wizard.
29012	Host %1$s: different time zone: %2$s instead of %3$s	The indicated host was detected using a different time zone from that of the Reporter. All system hosts should use the same time zone.
29013	Host %1$s: not time-synchronized, the difference is %2$s seconds	This indicated host was detected as having too large a time difference with the Reporter. All system hosts should have approximately the same system time setting.
29014	Host %1$s: failed to contact remote server to copy replay data to EPR	The Collector could not be reached. As a result, some session replay data has been lost.
29998	Internal error (%1$s)	This message reports that a generic internal error occurred.
29999	%1$s	Generic informational message.