Audit Log and Events – Enlighted Inc

Monitoring Audit Log

For each action initiated by a system user (including signing in), an audit log entry is created. All user roles, except, Employees, can view this log. The audit log is displayed by clicking on the Reports > Audit Log menu item. Below is a list of the audit log entry types, with a description of what action caused the entry to be created and possible events that could follow.

Audit log entry	User action that caused the entry to be created
Area Update	An area is created or deleted, or its attributes modified.
Assign Fixture Type	A fixture type is assigned to a fixture.
BACnet	The BACnet configuration is modified.
Ballast Add	A new type of ballast is added to the ballast list.
Ballast Change	A ballast type for a fixture is changed.
Ballast Delete	A ballast type is deleted.
Ballast Edit	The attributes of a ballast type are modified.
Building Update	A building is added or deleted, or its attributes modified.
Bulb Add	A type of bulb is added.
Bulb Delete	A type of bulb is deleted.
Bulb Edit	The attributes of a bulb are modified.
Campus Update	A campus is added or deleted, or its attributes modified.
Change Password	A user changed their password via the Change Password dialog box.
Cloud Server Update	An attribute for the cloud server configuration is modified.
DHCP Update	Use of DHCP enabled or disabled.
DR	A Demand Response event is scheduled.
EM Management	An EM image file has been uploaded or deleted; an EM backup file has been uploaded, downloaded, or deleted; or an EM backup has been initiated.
EM Management Upgrade/Restore	Either an EM system upgrade or EM restores from the backup file has been initiated.
EM Management Validation	The password for user admin has been validated when either EM Upgrade or Backup and Restore the selected from the Administration menu.
Enable/Disable Volt Participation	Lamp outage feature in a fixture and ballast has been enabled/disabled.
Events Update	The resolved attribute value of an event is changed.
ERC Commission	Either an ERC has commissioning initiated, or ERC commissioning has been stopped for a gateway.
ERC Discovery	ERC discovery has either started or is canceled
ERC Image Upgrade	An upgrade for an ERC image is initiated.
ERC Updated	The position of an ERC is changed.
Fixture Calibration	One or more fixtures initiated ambient light target value determination.
Fixture Commission	Any of the following occurred: A fixture commissioning is initiated for any fixture. A fixture is updated as part of the commissioning process. A fixture decommissioning is triggered with process status. A fixture commissioning is stopped for gateway.
Fixture Dimming	The light level of a fixture is changed via the GUI.
Fixture Discovered Deleted	The button Delete All Discovered Fixtures is clicked to remove fixtures that were discovered but not commissioned.
Fixture Discovery	Either of the following occurred: A fixture discovery is started. A fixture discovery is canceled.
Fixture Image Upgrade	An upgrade for a fixture image is initiated.
Fixture Mode Change	The mode of a fixture is changed (typically to Auto)
Fixture Profile Update	A profile is assigned to a fixture.
Fixture RMA	RMA is carried out on a fixture instead of commissioning
Fixture Update	The position of a fixture is changed, or any of the values of its attributes are changed.
Fixture Type Add	A new type of fixture is added.
Fixture Type Delete	A type of fixture is deleted.
Fixture Type Edit	The attributes of a fixture type are modified.
Floor Update	A floor is added or deleted, or its attributes modified.
Forget Ballast	Fixture curve for a ballast deleted.
Forget Fixture	Fixture curve for a fixture deleted.
Forgot Password	Forgot password link is clicked.
Gateway Add	A gateway is discovered.
Gateway Commission	A gateway decommissioning is triggered.
Gateway Image Upgrade	An upgrade for a gateway image is initiated.
Gateway Update	The position of a gateway is changed, or any of the values of its attributes are changed.
Group Fixture Update	Any of the following occurred: A group is applied to a list of new fixtures. A group is reassigned to a fixture list (removed from unchecked fixtures and added to newly checked fixtures). A group is removed from a list of fixtures. All groups are removed from the list of fixtures.
Group Update	A group is created or deleted, or its attributes are modified.
Import Ballast Curve	A ballast curve is imported.
Initiate Power Usage Characterization	Feature enabled in conjunction with the Lamp Outage feature.
LDAP Update	Any of the LDAP configurations are modified.
Locator Device Create	A locator device was added to the floor plan.
Locator Device Delete	A locator device was deleted from the floor plan.
Locator Device Update	The attributes of a locator device are updated.
Locator Device Update Position	The position of a locator device is modified.
Login	A user login is successful.
Motion Bits update	The attributes of an active motion window and motion sensitivity are modified.
Motion Group Update	The attributes of a motion group are updated.
Network Update	The network configuration of an EM is changed.
Organization Update	Either the initial system setup is completed, or any attribute of the organization is modified.
Placed Fixture Commission	Placed fixtures through EMConfig are commissioned.
Placed Fixture Delete	Placed fixtures through EMConfig are deleted.
Placed Plugload Commission	Placed plugloads through EMConfig are commissioned.
Plugload Commission	Any of the following occurred: A plugload commissioning is initiated for a plugload A plugload is updated as part of the commissioning process. A plugload decommissioning is triggered with process status. A plugload commissioning is stopped for gateway.
Plugload Dimming	The plugload output value is set to zero.
Plugload Discovered Delete	The button Delete All Discovered Plugloads is clicked to remove fixtures that were discovered but not commissioned.
Plugload Discovery	Either of the following occurred: A plugload discovery is started. A plugload discovery is canceled.
Plugload Image Upgrade	An upgrade for a plugload image is initiated.
Plugload Mode Change	The mode of a plugload is changed (typically to Auto).
Plugload Profile Delete	A plugload profile is deleted.
Plugload Profile Update	The attributes of a plugload profile are updated.
Plugload RMA	Return Merchandise Authorization (RMA) is carried out on a plugload instead of commissioning.
Plugload Update	The position of a plugload is changed, or any of the values of its attributes are changed.
Pricing Update	TOU pricing entry is added or deleted, or its attributes updated.
Profile Update	The attributes of a profile are updated.
Retrieve Power Usage Characterization	Information related to power usage characterization retrieved for a new set-up
Scene Update	A scene is added or deleted, or its attributes updated.
Switch Fixture Dimming	A switch is used to control the light level of fixtures.
Switch Fixture Update	The list of fixtures controlled by the switch is modified.
Switch Update	A switch is created or deleted, its position is changed, or its attributes modified.
Tenant Facility	The facility is assigned to a user.
Tenant Update	The facility assigned to a user is updated.
Unauthorized Access	Unauthorized access to an application
User Create	A user is created.
User Delete	A user is deleted.
User Facility Update	The facility assignments are changed.
User Update	Any of the user attributes are modified.

License Management Audit Log

Below is a list of the sensor audit log entry types for License Management with a description of the action that caused the entry to be created.

Audit Log Entry	Reason for Audit Log Entry	Description
License uploaded	When a user uploads the license file	Displays a message confirming “New license file successfully uploaded.”
Sensor Compliance Status	Checks the compliance every 24 hours and updates at 0:00 hours	Displays the total number of available SU5 sensor licenses and the number of used licenses. For example, Okay – 568 of 672 licenses in use.
Sensor License Status	When the quantity of Sensors exceeds the license, the quantity uploaded to the EM.	Displays the number of licenses exceeded and the available number of licenses. For example, Licenses Exceeded – 698 of 672 licenses.

DALI Emergency Lighting Audit Log Messages

Audit Log Entry	Reason for Audit Log Entry	Description
DALI Emergency Lighting Test	When a user initiates an emergency lighting test	Start the DALI emergency lighting Function or Duration test for the sensor.
DALI Emergency Lighting Test	When a user stops an emergency lighting test	Stop the DALI emergency lighting tests for the sensor.
DALI Emergency Lighting Test	When a user updates the emergency lighting driver parameters	Update DALI emergency lighting driver parameters for the sensor.

Login Attempt Audit Log Messages

Audit Log Entry	Reason for Audit Log Entry	Description
User Log In	When a user logs in.	Displays a message “User 'name' logged in.”
User Log Out	When a user logs out.	Displays a message “User 'name' logged out.”
Failed Login Attempt	When a user attempts to log in, and it fails.	Displays a message “User 'name' login failed.”
Inactive Session Timeout	When a user is logged out of the application after being idle for a specific duration.	Displays a message “User 'name' logged out.”

Administrators can now track user failed login attempts in the Audit Log.
Administrators can now track logouts and inactive session timeouts in the Audit Log.

To view the Audit Log details, refer to the article Displaying Audit Log.

Displaying Audit Log

To view the list of all the audit log entry types with the description of what action caused the entry to be created, and possible events that could follow, refer to the article Monitoring Audit Log.

The audit display includes a section where filters can be applied to select entries from the list and a resulting list of audit entries. The following is an example screen:

Click the >> Filter label to show or hide the filter section. An example of the filter section is as follows:

The attributes that must match are selected, and the Submit button is clicked to show only those matching entries in the audit log.

Monitoring Events

Each event that occurs on the system is recorded. An event that is an action initiated by an administrator is called an audit event and is managed separately from other event types. Audit events are described in Monitoring Audit Log. Sometimes, an action may result in one or more events. There may be a separate event for when an action was started, when it was completed successfully or failed, or when it was aborted. Other events occur due to periodic actions that are performed by the system or fixture.

For example, periodically, a fixture performs a health self-check. If it detects any problem, it then communicates the problem to Manage, which may generate an event. Likewise, Manage performs periodic health check actions, and if it detects a problem, it may generate an event.

Note that some problem detections do not cause an event to be reported. If a problem is a persistent fault condition, then an event will only be reported the first time it is detected. For example, if the ballast in a fixture ceases to function, then the first time it is detected, the event fixture out is reported. Until the fault condition is cleared, no additional events are reported for the condition.

The events can be accessed from the Events tab by selecting either Facilities or Profiles.

Below is a list of the events, and where appropriate, the possible action(s) that the administrator should pursue to resolve each fault condition:

Attached Storage Backup – Informational report about the daily scheduled backup. The daily backup runs every day at 1:00 am and 4:00 am, backing up the system file to an external storage drive. If the system does not find an attached storage device to the EM server, the backup script stores the backup file on the server and generates a critical event.
Auto Recovering Lost Sensors – The daily auto-recovery runs every day at 2:00 am to recover unreachable commissioned sensors and recommissions them by sending the configured wireless settings to these sensors. During this time, the following event messages are sent.
- Attempting to find and recover sensors that lost communication: This event is sent at the beginning of the sensor recommission operation for a gateway.
- xx:yy:zz sensor could not be recovered: xx:yy:zz is the sensor's MAC address that failed to acknowledge recommissioning.
- Attempt to recover lost sensors is complete. Discovered ‘NN’ number of sensors that failed to communicate. Recovered ‘NN’ number of sensors.
- Recommissioning failed: Gateway did not move to the default channel. This is an alarm with the severity of ‘Major’ as this is a serious network condition warning.
BACnet – Informational reports about the service that supports the BACnet protocol. The service is started when the EM is started, such as after system power on, or after system image upgrade. The event types are:
- Service started
- Service stopped
- Configuration changed
Bad Profile – Reported by a Fixture (SU).
- The fixture determined a corrupted value in a profile in RAM and reported it to Manage. Try power cycling the fixture. If the problem is not resolved, then replace the sensor (SU) of the fixture.
- The fixture determined a corrupted value in a profile in ROM and reported it to Manage (which means that flash memory in the SU is corrupted). Try power cycling the fixture. If the problem is not resolved, then replace the sensor (SU) of the fixture.
Commissioning – Informational reports on the commissioning process, which is initiated by an administrator. The event types are:
- Started
- Start failed
- Timed out due to inactivity
- Aborted
- Succeeded
Discovery – Informational reports on the discovery process for devices (sensors, gateways, and ERCs), which is initiated by an administrator. The event types are:
- Started
- Start failed
- Timed out before finding a specified count of fixtures
- Found specified count of fixtures
Download Power Usage Characteristics – When used in conjunction with the Lamp Outage function, it detects lamps that do not conform to the specified behavior.
Demand Response Condition – Informational reports on the DR process, which is initiated by an administrator.
- DR condition initiated
- DR condition canceled
EM Upgrade – Not used
Email Notification – Sends events as email notifications. See Configuring Email Notifications.
ERC Commissioning – Information on ERC commissioning.
ERC Discovery – Message about the discovery of an ERC via a Gateway.
ERC Upgrade – This event relates to the image upgrade of an ERC.
Erroneous energy reading – The problem is detected, and an event is created when the energy usage reported by a fixture during a five-minute interval is too high. The reported energy usage is discarded, and a value is computed for the energy usage of the five-minute interval.
Fixture associated Group Changed – Not in use.
Fixture Configuration Upload – This implies that fixture details are being uploaded externally, usually for a fixture discovered from EMConfig.
Fixture CPU Usage is High – The problem is detected and reported by the fixture, and Manage creates an event. This could indicate a damaged Sensor unit (SU). Try replacing it.
Fixture CU Failure – The problem is reported by the fixture, and Manage creates an event. Try power cycling the fixture. If the problem is not resolved, replace the cable between the Control Unit and the sensor. If the problem persists, first try replacing the CU, and if the problem persists, then replace the sensor.
Fixture Emergency Lighting Test – Reports that the emergency lighting test on the fixture has ended.
Fixture Group Change – This implies that a fixture is being assigned to a group or switch.
Fixture Hardware Failure – The problem is detected and reported by the fixture, and the EM creates an event. The fixture report will specify the state, the sub-system or component where the problem occurred, and the fault type. The state could be at power-on-self-test (POST) time, initial time, or runtime. It also reports the fault type. Typically, this issue is resolved by replacing the SU.
Fixture Image checksum failure – The fixture detected that the checksum for its image is incorrect. Try power cycling the fixture. If the problem persists, then try upgrading the image. If the problem still persists, then replace the SU.
Fixture out – Reports that occur when an SU is periodically reporting its energy usage, and the first time it is detected that either the ballast or bulbs are out for a fixture. Typically, this must be resolved by replacing the component that has ceased functioning.
Fixture too hot – The problem is detected and reported by the fixture, and Manage creates an event. The temperature reported by the fixture is included in the event report. To resolve, check for unusual heat sources. If none are found, this could indicate a defective temperature sensor in the SU. Try replacing the SU.
Fixture Upgrade – Informational reports on the image upgrade process for a fixture, which is initiated by an administrator. The event types are:
- Image upgrade initiated
- Image upgrade didn’t start
- Image upgrade started
- Image upgrade aborted
- Image upgrade succeeded
- Image upgrade failed
Gateway configuration error – The problem is detected, and an event is created. This event occurs when the configured and current wireless parameters are different on the gateway. After reporting, the EM auto-corrects the problem by sending the configured wireless parameters to the gateway. To resolve, try power cycling the gateway. When done, make sure that the gateway gets an IP Address. Verify by pinging the gateway from the EM or from a system on the building network.
Gateway Connection Failure – The problem is detected, and an event is created by the EM when an SSL connection cannot be established with the gateway because it is unreachable or the SSL authentication fails.
Gateway unreachable – This implies that the gateway is not reachable from the EM.
Gateway Upgrade – Informational reports on the image upgrade process for a gateway, which is initiated by an administrator. The event types are:
- Image upgrade started
- Image Upgrade didn’t start
- Image upgrade aborted
- Image upgrade succeeded
- Image upgrade failed
Network Notification – This implies that network assignments have been changed.
Placed Fixture Upload – This implies that a fixture is being uploaded with a Mac Id that is already commissioned.
Plugload High Current- This generates an alarm when the plugload current (in Amperes) is higher than the specified limit.
Profile Mismatch- This event is triggered when a profile push or a group profile push does not go through due to a mismatch in the profiles of fixtures and fixture groups.
Profile Mismatch User Action – This event is triggered during a profile push or a group profile push when although the sensor profile matches the group profile, the sensor profile checksum does not match the scheduled sensor profile checksum or the global profile checksum.
Push profile – The fixture profile has changed, but it has not yet been stored on the fixture. This occurs when a fixture is powered off, or there is no network connectivity between the fixture and EM, and when the fixture’s profile is changed in the EM.
Scheduler – During an EM image upgrade, the scheduler is stopped and later restarted. Additionally, if it is found to be not running, the system health checker will restart the scheduler.
Sftp Remote Backup – Informational report about the daily scheduled backup. The daily backup runs every day at 1:00 am, and 4:00 am, backing up the system file to a remote server using a secure file transfer protocol. A critical event is sent if the system cannot upload the backup file to the remote server but has stored it on the server.
Wireless Parameters – This event is generated when a fixture or a plugload is deleted, but per minute statistics are still available from the Gateway operating in a normal mode.

To display events, refer to the article Displaying Events.

Configure Email Server

To enable receiving notifications of scheduled and critical events, configure your email server parameters to receive notifications from the Energy Manager (EM). Obtain the following details from your IT department to configure the email server.

Host email server address, for example, smtp.example.com
Port number, for example, port 993
User’s email address and password
Type of Protocol supported (SMTP or SMTPS)
Authentication: If the email server requires username and password authentication to send emails
Security setting for the connection with the server (for example, TLS encryption supported). Check the box whether to use secure authentication)

To configure an email account, navigate to Administration-> System Management and select the Email Configuration tab. The following screen is displayed, listing the details required. Type the required configuration details and click the Save button to configure the email account.

To receive events as an email notification, refer to the article Configuring Email Notifications.

License Management Audit Log

DALI Emergency Lighting Audit Log Messages

Login Attempt Audit Log Messages

Recommended articles:

Recommended articles:

Configure Email Server

Recommended articles:

Recommended articles:

Recommended articles: