All events in Security Center are associated with a source entity, which is where the event originates from.
NOTE: When specifying the source entity
(From list) in the Event-to-action dialog box,
events that apply to doors also apply to areas, and events that apply to cardholders also
apply to cardholder groups and visitors. To receive health events, you must configure
them in the Health Monitor role's Properties page.
Security
Center supports the following event
types:
| Event | Source entity | Description |
|---|---|---|
| A door of an interlock has an unlock schedule configured | Area | A door that is part of an interlock configuration has an unlock schedule configured. |
| A door of an interlock is in maintenance mode | Area | A door that is part of an interlock configuration is in maintenance mode. |
| Ability to write on a drive as been restored | Archiver or Auxiliary Archiver role | The ability to write on a drive has been restored. |
| AC fail | Access control unit or intrusion detection unit | The alternating current (AC) has failed. |
| Access denied | Cardholder, credential, door, or elevator | A cardholder is denied access (for any reason). |
| Access denied: A second cardholder is required | Door | Two cardholders must present their credentials within a certain delay of each other and the delay has expired. This event only applies to doors controlled by Synergis™ units. |
| Access denied: Antipassback violation | Door | A cardholder requested access to an area that they have already entered, or requested access to leave an area that they were never in. |
| Access denied: Card and PIN timeout | Door or elevator | A card and PIN are required to enter an area, and the cardholder did not enter the PIN within the allotted time. |
| Access denied: Companion was denied | Door or elevator | The two-person rule is enforced, and one of the cardholders was denied access. |
| Access denied: Denied by access rule | Door or elevator | The cardholder is denied access according to the access rule. |
| Access denied: Escort not supported by this unit model | Door or elevator | The visitor escort rule is enforced on an area, but the unit controlling its doors does not support this feature. |
| Access denied: Expired credential | Cardholder, credential, door, or elevator | An expired credential has been used. |
| Access denied: First-person-in rule supervisor absent | Door or elevator | The first-person-in rule has been enforced on the area, and no supervisor has arrived yet. |
| Access denied: Host is required | Door or elevator | The visitor escort rule is enforced and the visitor is badged before the host. |
| Access denied: Inactive cardholder | Cardholder, door, or elevator | A cardholder with an inactive profile has attempted to access a door or elevator. |
| Access denied: Inactive credential | Cardholder, credential, door, or elevator | A credential with an inactive profile has been used. |
| Access denied: Insufficient privileges | Door or elevator | The cardholder is denied access because they do not have the required security clearance. This event only applies to doors controlled by Synergis units. |
| Access denied: Interlock | Door | Access is denied because of an interlock constraint. |
| Access denied: Invalid PIN | Door or elevator | The cardholder entered an invalid PIN. |
| Access denied: Lost credential | Cardholder, credential, door, or elevator | A credential that has been declared as lost has been used. |
| Access denied: Max occupancy reached | Door or elevator | The cardholder is denied because the area is at its occupancy limit. |
| Access denied: No access rule assigned | Door or elevator | The cardholder is denied access because they are not assigned any access rights. |
| Access denied: Out of schedule | Door or elevator | The access rule associated with this cardholder does not apply during the date or time specified in the schedule. |
| Access denied: Stolen credential | Cardholder, credential, door, or elevator | A credential that has been declared as stolen has been used. |
| Access denied: Unassigned credential | Credential, door, or elevator | A credential that has not been assigned to a cardholder has been used. |
| Access denied: Unknown credential | Door or elevator | A credential that is unknown in the Security Center system has been used. |
| Access denied: Valid card, inactive PIN | Door or elevator | A card and PIN are required to enter an area, and the cardholder entered an inactive PIN. |
| Access denied: Valid card, invalid PIN | Door or elevator | A card and PIN are required to enter an area, and the cardholder entered an invalid PIN. |
| Access granted | Cardholder, door, or elevator | Access has been granted through a door to a cardholder according to the access
rules governing the door, elevator, or area. NOTE: For a
perimeter door of an interlock: When an authorized cardholder accesses a door of
an interlock, Security Center might generate an Access granted event for
the door even though the door does not unlock (due to another perimeter door
already being open).
|
| Adaptive motion triggered | Camera (video analytics) | Motion has been detected on a camera monitored by KiwiVision™ Video Analytics or equipped with similar capabilities. |
| Agent started | Wearable Camera Manager role | The health event generated when a role agent starts. |
| Agent stopped | Wearable Camera Manager role | The health event generated when a role agent stops. |
| Agent stopped unexpectedly | Wearable Camera Manager role | The health event generated when a role agent stops unexpectedly. |
| Alarm acknowledged | Alarm | An alarm has been acknowledged by a user, or auto-acknowledged by the system. |
| Alarm acknowledged (alternate) | Alarm | An alarm has been acknowledged by a user using the alternate mode. |
| Alarm being investigated | Alarm | An alarm with an acknowledgment condition that is still active has been put into the under investigation state. |
| Alarm condition cleared | Alarm | The acknowledgment condition of an alarm has been cleared. |
| Alarm context changed | Alarm | The Context field of an alarm has been edited by a user. |
| Alarm forcibly acknowledged | Alarm | An alarm has been forcibly acknowledged by a user with special privileges. |
| Alarm trigger rate high | Directory role | The health event generated when the alarm trigger rate rises above the high threshold configured in the Health Monitor role's Properties page for this event. |
| Alarm trigger rate normal | Directory role | The health event generated when the alarm trigger rate drops below the normal threshold configured in the Health Monitor role's Properties page for this event. |
| Alarm triggered | Alarm | An alarm has been triggered. |
| An interlock cannot be in hard antipassback mode | Area | An interlock cannot be in hard antipassback mode. This combination is an illegal configuration. |
| An interlock cannot have a perimeter door with no door sensor configured | Area | Interlock cannot be enforced if the system cannot tell whether a door is open or not. |
| An interlock cannot have only one perimeter door | Area | You need at least two perimeter doors for interlock to be applied. |
| Antipassback disabled: Invalid settings | Area | Antipassback disabled: Invalid settings. |
| Antipassback disabled: Not supported when unit is not in server mode | Area | Units have not been set to server mode. Antipassback is available according to the unit’s operating mode. For more information about unit limitations, see Limitations in Security Center. |
| Antipassback violation | Area, cardholder, or visitor | An access request was made to enter an area with a credential that is already inside the area, or to exit an area with a credential that was never in the area. |
| Antipassback violation forgiven | Cardholder or visitor | A security operator has granted access to a cardholder responsible for a passback violation. |
| Application connected | Security Desk | The health event generated when a user connects to the Directory through Security Desk. |
| Application disconnected by user | Security Desk | The health event generated when a user disconnects his Security Desk from the Directory. |
| Application disconnected unexpectedly | Security Desk | The health event generated when a Security Desk application is disconnected from the Directory, but not by the user (network issue or application crash). |
| Application lost | Application or role | An application or a role has lost its connection to the Directory. |
| Application started | Security Desk | The health event generated when a Security Desk application starts. |
| Application stopped | Security Desk | The health event generated when a Security Desk application is stopped manually. Stopping Security Desk and disconnecting it from the Directory are not necessarily done at the same time. For example, Security Desk can run without being connected to the Directory. |
| Application stopped unexpectedly | Security Desk | The health event generated when a Security Desk application is stopped unexpectedly, for example, by a crash. |
| Archive backup failed | Archiver role or camera | The health event generated when a Backup archive transfer operation failed. |
| Archive backup succeeded | Archiver role or camera | The health event generated when a Backup archive transfer operation succeeded. |
| Archive duplication canceled | Archiver role or camera | The health event generated when a Duplicate archives archive transfer operation is canceled. |
| Archive folder path is too long | Archiver or Auxiliary Archiver role | The disk base path for video archives has exceeded the maximum length permitted by the operating system. |
| Archive transfer sequence imported | Camera | A new video sequence is made available for use in the Archiver. The type of
transfer and the start and end time of the imported sequence are shown in the event
description. The possible transfer types are:
|
| Archiving disk changed | Archiver or Auxiliary Archiver role | The Allotted space on one of the disks assigned for archive storage for this archiving role has been used up, and the role has switched to the next disk in line. The names of the previous disk and current disk are indicated in the event description. |
| Archiving queue full | Camera | A camera (video encoder) is streaming video faster than the Archiver is able to write the video packets to disk. A problem with the Archiver database also triggers this event. The name of the camera whose packets are lost is indicated in the event description. |
| Archiving started | Archiver or Auxiliary Archiver role | The health event generated when the Archiver role is ready to archive video. |
| Archiving stopped | Archiver or Auxiliary Archiver role | Archiving has stopped because the disks allocated for archiving are full. This event always accompanies a Disk full event. |
| Asset moved | Asset | An asset has been moved. |
| Asset offline | Asset | The RFID tag of an asset has gone offline. |
| Asset online | Asset | The RFID tag of an asset has been put online. |
| Audio alarm | Camera | A sound has been picked up by a microphone associated with a camera. |
| Audio analytics event | Camera (video analytics) | An audio analytics event has been detected on a camera equipped with audio analytics capabilities. |
| Badge printing job canceled | Cardholder or visitor | A user has canceled a badge printing job. |
| Badge printing job completed | Cardholder or visitor | A user has completed a badge printing job. |
| Badge printing job queued | Cardholder or visitor | A user has queued a badge printing job. |
| Battery fail | Access control unit or intrusion detection unit | The unit battery has failed. |
| Below max occupancy | Area | The number of people in the area has dropped under the maximum occupancy limit. |
| Block camera started | Camera | A user has blocked a video stream from other users in the system. |
| Block camera stopped | Camera | A user has unblocked a video stream from other users in the system. |
| Camera recording problem | Camera | The health event generated when the camera is not able to record its video. |
| Camera recording recovered | Camera | The health event generated when the camera is able to record again. |
| Camera tampering | Camera (video analytics) | A dysfunction has occurred, potentially due to camera tampering, resulting in a partial or complete obstruction of the camera view, a sudden change of the field of view, or a loss of focus. |
| Cannot write on the specified location | Archiver or Auxiliary Archiver role | The archiving role cannot write to a specific drive. The path to the drive is indicated in the event description. |
| Cannot write to any drive | Archiver or Auxiliary Archiver role | The archiving role is unable to write to any of the disk drives. Archiving is stopped for the following reasons: when write-access to shared drives are revoked; when shared drives are inaccessible; when shared drives no longer exist. The role re-evaluates the drive status every 30 seconds. |
| Certificate error | Access control and video unit | The health event generated by the Unit Assistant role when there is a problem with the certificate of the unit it manages. |
| Certificate valid | Access control and video unit | The health event generated by the Unit Assistant role when the certificate is valid after having a warning or an error. |
| Certificate warning | Access control and video unit | The health event generated by the Unit Assistant role when the certificate has a non-critical issue. For example, when the certificate is about to expire. |
| Connection failed | AD role, Federation™ role, or GCS role | The health event generated when the role is not able to connect to the remote component. |
| Connection restored | AD role, Federation™ role, or GCS role | The health event generated when the role is able to connect to the remote component again. |
| Connection to camera established | Camera | The health event generated when the Archiver role connects to the camera. |
| Connection to camera stopped by user | Camera | The health event generated when the Archiver role disconnects from the camera through a user action. For example, a role stopped by the user. |
| Connection to camera stopped unexpectedly | Camera | The health event generated when the disconnection of the Archiver role from the camera is not intentional. For example, the role crashed, network disconnection, and so on. |
| Connection to unit established | Unit | The health event generated when the role connects to the unit. |
| Connection to unit stopped by user | Unit | The health event generated when the role disconnects from the unit through a user action. For example, a role stopped by the user. |
| Connection to unit stopped unexpectedly | Unit | The health event generated when the disconnection of the role from the unit is not intentional. For example, the role crashed, network disconnection, and so on. |
| Consolidating archives failed | Camera | The health event generated when an archive consolidation operation failed for a camera. For more information, see Consolidating video archives after Archiver failover. |
| Consolidating archives partially failed | Camera | The health event generated when an archive consolidation operation partially failed for a camera. For more information, see Consolidating video archives after Archiver failover. |
| Consolidating archives succeeded | Camera | The health event generated when an archive consolidation operation succeeded for a camera. For more information, see Consolidating video archives after Archiver failover. |
| Convenience time started | Parking rule | The convenience time portion of the parking session has begun. |
| Could not connect to Cloud Storage | Archiver role | The Archiver role cannot connect to the Cloud Storage. |
| CPU usage high | Server | The health event generated when the CPU usage of the server rises above the threshold configured in the Health Monitor role's Properties page for this event. |
| CPU usage normal | Server | The health event generated when the CPU usage of the server drops below the threshold configured in the Health Monitor role's Properties page for this event. |
| Crowd detected | Camera (video analytics) | The crowd size or queue length has reached the configured threshold on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. The crowd size is indicated in the event description. |
| Crowd size | Camera (video analytics) | The crowd size has been estimated for a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. The crowd size is indicated in the event description. This event is usually generated at regular intervals by KiwiVision™ People Counter or a similar module. |
| Custom event | (System-wide) | A custom event is an event added after the initial system installation. Events defined at system installation are called system events. Custom events can be user-defined or automatically added through plugin installations. Unlike system events, custom events can be renamed and deleted. |
| Database automatic backup failed | Directory role | The health event generated when the backup and restore feature is not working. |
| Database automatic backup restored | Directory role | The health event generated when the backup and restore feature was successful. |
| Database lost | Any role using a database | The connection to the role database was lost. If this event is related to a role database, it might be because the database server is down or cannot be reached by the role server. If the event is related to the Directory database, the only action you can use is Send an email because all other actions require a working connection to the Directory database. |
| Database recovered | Any role using a database | The connection to the role database has been recovered. |
| Database restore failed | Directory Manager role | The health event generated when the Directory database failover backup and restore feature failed. |
| Database restore succeeded | Directory Manager role | The health event generated when the Directory database failover backup and restore feature was successful. |
| Database space low | Any role using a database | The health event generated when the available disk space drops below the threshold configured in the Health Monitor role's Properties page for this event. |
| Database space normal | Any role using a database | The health event generated when the available disk space rises above the threshold configured in the Health Monitor role's Properties page for this event. |
| Deadbolt locked | Zone | The deadbolt on a door has been locked. |
| Deadbolt unlocked | Zone | The deadbolt on a door has been unlocked. |
| Direction alarm | Camera (video analytics) | A direction alarm has been triggered on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Directory started | Directory role | The health event generated when the Directory role starts. This can only happen if you have more than one Directory server. |
| Directory stopped by user | Directory role | The health event generated when the Directory role does a clean shutdown. For example, when Genetec™ Server is stopped in Windows services. |
| Directory stopped unexpectedly | Directory role | The health event generated when the Directory role stopped unintentionally. For example, during a server crash. |
| Disk access restored | Archiver or Auxiliary Archiver role | The role regained access to its disks. |
| Disk access unauthorized | Archiver or Auxiliary Archiver role | The role is not able to access its disks. |
| Disk load threshold exceeded | Archiver or Auxiliary Archiver role | The disk space allocated for archiving has exceeded its load threshold (default=90%). The excess is caused by under-evaluating the disk space required, or by another application that is taking more disk space than it should. If 100% of the allotted disk space is used, the Archiver starts to delete old archive files prematurely to free disk space for new archive files, starting with the oldest files. |
| Disks full | Archiver or Auxiliary Archiver role | All disks allotted for archiving are full and the Archiver is unable to free disk space by deleting existing video files. This event can occur when another application has used up all the disk space reserved for Security Center, or when the Delete oldest files when disks full option is not selected in the Server Admin. When this happens, archiving is stopped. The Archiver re-evaluates the disk space every 30 seconds. |
| Door closed | Door | The door has closed. For this event to be generated, the door must be equipped with a door sensor. |
| Door forced open | Door | The door is locked but the door sensor indicates that the door is open. |
| Door locked | Door | The door is considered locked in Security Center. |
| Door maintenance completed | Door | The door has been taken out of maintenance mode. |
| Door maintenance started | Door | The door has been put into maintenance mode. |
| Door manually unlocked | Door | In Security Desk, a user has manually unlocked a door. |
| Door offline: Device is offline | Door | One or more devices associated to this door has gone offline. |
| Door online | Door | The door is back online after being offline. |
| Door opened | Door | The door has opened. For this event to be generated, the door must be equipped with a door sensor. |
| Door open too long | Door | The door has been held open for too long. To enable this event, you must set the Trigger event to ON in the Door held section of the door's Properties page in Config Tool. |
| Door secured | Door | The door has been properly closed and locked after a Door unsecured event. For this event to be generated, the door must be equipped with a door sensor, a door lock, and a lock sensor. |
| Door test completed successfully | Door | The door test has been completed successfully. |
| Door test failed | Door | The door test has failed. |
| Door test failed: Aborted | Door | The door test has been aborted. |
| Door test failed: Canceled because door is unsecured | Door | The door test has been canceled because the door is not secured. |
| Door test failed: Canceled because of shunted readers | Door | The door test has been canceled because readers are shunted. |
| Door test failed: Door failed to relock | Door | The door test has failed because the door did not relock. |
| Door test failed: Door failed to unlock | Door | The door test has failed because the door did not unlock. |
| Door test failed: Error occurred | Door | The door test has failed because an error occurred. |
| Door test started | Door | The door test has started. |
| Door unlocked | Door | The door has been unlocked. |
| Door unsecured | Door | The door has been unlocked, but the door lock indicates that the door is locked. For this event to be generated, the door must be equipped with a door sensor, a door lock, and a lock sensor. |
| Doorknob in place | Zone | The doorknob is in place and the door is closed. |
| Doorknob rotated | Zone | The doorknob has rotated. |
| Double-badge off | Cardholder, credential, or door | The door has been locked and an associated event has stopped. |
| Double-badge on | Cardholder, credential, or door | The door has been unlocked and an associated event has been triggered. |
| Duplicating archives failed | Archiver role or camera | The health event generated when a Duplicate archives archive transfer operation failed. |
| Duplicating archives partially failed | Archiver role or camera | The health event generated when a Duplicate archives archive transfer operation failed half-way through. |
| Duplicating archives succeeded | Archiver role or camera | The health event generated when a Duplicate archives archive transfer operation succeeded. |
| Duplicating archives will retry | Archiver role or camera | The health event generated when a Duplicate archives archive transfer operation failed but will retry later. |
| Duress PIN entered | Cardholder or door | A cardholder entered a duress PIN at a door. |
| Edge storage medium failure | Camera or video unit | After a unit was restarted, the video that was recorded on the edge could not be accessed. |
| Edge storage recording state | Camera | Recording on the edge has started or stopped. The recording state, "Started" or "Stopped" is indicated in the event description. |
| Elevator offline: Device is offline | Elevator | One or more devices associated to this elevator has gone offline. |
| End of camera tampering | Camera (video analytics) | A dysfunction, which might have been caused by camera tampering, has been resolved. |
| Entity has expired | Cardholder or credential | A credential or its associated cardholder has expired (its status is now Expired). |
| Entity is expiring soon | Credential | Security Center generates this event to warn you that the expiry date of an entity is approaching. The number of days of advance warning provided by this event must be set. |
| Entity is offline | Server, role, or unit | The health event generated when an entity goes offline (red). |
| Entity is online | Server, role, or unit | The health event generated when an entity is back online (black). |
| Entity warning | Any entity | A health warning has been issued for this entity. |
| Entry assumed | Cardholder or door | A cardholder was granted access to a door or area, and it was assumed that they entered because no door sensor is configured. |
| Entry detected | Cardholder or door | A cardholder was granted access to a door or area, and their entry is detected. For this event to be reliable, an entry sensor must be configured on the door side where entry is to be detected. If no entry sensors are configured on the door, the event is generated based on the door sensor input. |
| Evacuation ended | Area | An evacuation from the area has ended. This event is generated from the Evacuation Assistant plugin. |
| Evacuation started | Area | An evacuation from the area has been started. This event is generated from the Evacuation Assistant plugin. |
| Face detected | Camera (video analytics) | A face has been detected on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Face recognized | Camera (video analytics) | A face on a hotlist has been recognized by a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Failed to create a signed token | Directory role | The health event generated when the system cannot generate a token for authentication. |
| File deleted | Camera | A video file associated to a camera has been deleted because the retention period has ended, or the archive storage disk was full. |
| Files deleted before cloud upload because disk is full | Camera | Video archives are deleted before cloud upload because the archive storage disk is full. |
| Files deleted before cloud upload because retention period exceeded | Camera | Video archives are deleted before cloud upload because the local retention period has ended. |
| Firmware upgrade canceled | Access control unit | A firmware upgrade on an access control unit has been canceled. |
| Firmware upgrade failed | Access control unit | A firmware upgrade on an access control unit has failed. |
| Firmware upgrade scheduled | Access control unit | A firmware upgrade on an access control unit has been scheduled. |
| Firmware upgrade started | Access control unit | A firmware upgrade on an access control unit has started. |
| Firmware upgrade succeeded | Access control unit | A firmware upgrade on an access control unit has been completed successfully. |
| First person in | Area | A cardholder has entered an empty area. |
| Floor accessed | Elevator | An elevator floor button has been pressed. |
| Glass break | Zone | Glass has broken. |
| Grace period started | Parking zone | The grace period for a parking session has started. |
| Hardware tamper | Access control unit, door, elevator, or zone | The tamper input on a unit has been triggered. |
| Health event | Health Monitor role | A health event has occurred. |
| Heat map changed | Camera (video analytics) | A change has been detected in a heat map area on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| High event rate | Archiver role | The incoming event rate of the Archiver has reached the configured
threshold. NOTE: When this happens, the role can run out of disk space. The default
threshold is 10,000 events in 5 minutes. The administrator can modify the
threshold in the Advanced settings of the Archiver role. For
more information, see "Monitor incoming events" in Archiver - Resources tab.
|
| Hotlist changed | Hotlist | A hotlist has been modified. |
| Input alarm activated | Input on an intrusion detection unit | The input has entered an alarm state. |
| Input alarm restored | Input on an intrusion detection unit | The input has left an alarm state. |
| Input bypassed | Input on an intrusion detection unit | The input has entered a bypassed state. |
| Input bypass restored | Input on an intrusion detection unit | The input has left a bypassed state. |
| Input shunted | Input on an access control unit | The input has been shunted. |
| Input state changed: Input active | Input on a camera, access control unit, or intrusion detection unit | The input has entered an active state. |
| Input state changed: Input normal | Input on a camera, access control unit, or intrusion detection unit | The input has entered a normal state. |
| Input state changed: Input trouble | Input on an access control unit or intrusion detection unit | The input has entered a trouble state. |
| Input trouble - open | Access control or intrusion detection unit | Supervised input has entered a trouble state (open circuit). |
| Input trouble - short | Access control or intrusion detection unit | Supervised input has entered a trouble state (short circuit). |
| Input unshunted | Input on an access control unit | The previously shunted input has been restored to its normal function. |
| Interface module AC fail state active | Door | The AC (alternating current) of an interface module has failed. |
| Interface module AC fail state restored | Door | The AC (alternating current) of an interface module has been restored. |
| Interface module battery fail state active | Door | The battery of an interface module has failed. |
| Interface module battery fail state restored | Door | The battery of an interface module has been restored. |
| Interface module firmware upgrade canceled | Access control unit | A firmware upgrade on an interface module has been canceled. |
| Interface module firmware upgrade failed | Access control unit | A firmware upgrade request has failed, or there are firmware upgrades past their scheduled start time after the Access Manager role is restarted. |
| Interface module firmware upgrade package transfer started | Access control unit | A firmware upgrade request has been sent to the Synergis™ Cloud Link unit. |
| Interface module firmware upgrade scheduled | Access control unit | A firmware upgrade on an interface module has been scheduled. |
| Interface module firmware upgrade started | Access control unit | A firmware upgrade on an interface module has started. |
| Interface module firmware upgrade succeeded | Access control unit | A firmware upgrade on an interface module has succeeded. |
| Interface module offline | Access control unit | The interface module has gone offline. |
| Interface module online | Access control unit | The interface module has come online. |
| Interface module tamper state active | Door | The tamper input of an interface module has been triggered. |
| Interface module tamper state restored | Door | The tamper input of an interface module has returned to normal. |
| Interlock is not supported by the unit | Area | Interlock is enabled on an area but the access control unit controlling the doors does not support this feature. |
| Interlock lockdown input active | Area | Interlock lockdown has been turned on. |
| Interlock lockdown input normal | Area | Interlock lockdown has been turned off. |
| Interlock override input active | Area | Interlock override is on. |
| Interlock override input normal | Area | Interlock override is off. |
| Intrusion alarm silenced | Intrusion detection area | Intrusion alarm has been silenced. |
| Intrusion detection area alarm activated | Intrusion detection area | Intrusion detection area alarm activated. |
| Intrusion detection area arming | Intrusion detection area | Intrusion detection area is being armed. |
| Intrusion detection area armings postponed | Intrusion detection area | Intrusion detection area arming is postponed. |
| Intrusion detection area canceled alarm | Intrusion detection area | Intrusion detection area alarm is canceled. |
| Intrusion detection area canceled postponed request | Intrusion detection area | Intrusion detection area-postponed request is canceled. |
| Intrusion detection area disarm request | Intrusion detection area | Intrusion detection area-postponed request is canceled. |
| Intrusion detection area disarmed | Intrusion detection area | Intrusion detection area is disarmed. |
| Intrusion detection area duress | Intrusion detection area | Intrusion detection area is disarmed with duress. |
| Intrusion detection area entry delay activated | Intrusion detection area | Intrusion detection area entry delay activated. |
| Intrusion detection area forced arming | Intrusion detection area | Intrusion detection area is forcefully armed. |
| Intrusion detection area input bypass activated | Intrusion detection area | Intrusion detection area input bypass is activated. |
| Intrusion detection area input bypass deactivated | Intrusion detection area | Intrusion detection area input bypass is deactivated. |
| Intrusion detection area input trouble | Intrusion detection area | Intrusion detection area input trouble. |
| Intrusion detection area master arm request | Intrusion detection area | Intrusion detection area master arm request is issued. |
| Intrusion detection area master armed | Intrusion detection area | Intrusion detection area is master armed. |
| Intrusion detection area perimeter arm request | Intrusion detection area | Intrusion detection area perimeter arm request is issued. |
| Intrusion detection area perimeter armed | Intrusion detection area | Intrusion detection area is perimeter armed. |
| Intrusion detection area postponed arming request | Intrusion detection area | Intrusion detection area armings request is postponed. |
| Intrusion detection unit input bypass activated | Intrusion detection unit | Intrusion detection unit input bypass is activated. |
| Intrusion detection unit input bypass deactivated | Intrusion detection unit | Intrusion detection unit input bypass is deactivated. |
| Intrusion detection unit input trouble | Intrusion detection unit | Intrusion detection unit input trouble. |
| Intrusion detection unit tamper | Intrusion detection unit | Intrusion detection unit has been tampered with. |
| Invalid configuration in unit | Video unit | The configuration of the unit is invalid. |
| Invalid custom encryption values | Archiver or Auxiliary Archiver role | This warning is issued by the Archiver on start-up and every 5 minutes if one of the custom encryption values (initial fingerprint or encryption key) specified in the Server Admin is invalid. |
| Inventory reset | Parking zone | The inventory of a parking zone has been reset to zero so that the reported parking zone occupancy can be re-initialized. |
| Last person out | Area | The last cardholder has exited an area. |
| License plate hit | Any hit rule | A license plate read has been matched to a hotlist, an overtime rule, or a permit restriction. |
| License plate read | ALPR unit or Genetec Patroller™ | A license plate has been read. |
| Live bookmark added | Camera | A user has added a bookmark to a live video. |
| Live streaming started | Camera (Mobile) | Live streaming from a mobile phone camera has started. |
| Live streaming stopped | Camera (Mobile) | Live streaming from a mobile phone camera has stopped. |
| Lock released | Zone | Event related to a zone entity. |
| Lock secured | Zone | Event related to a zone entity. |
| Loitering | Camera (video analytics) | Loitering activity has been detected in the camera footage. |
| Low battery | Asset | The battery on the RFID tag of an asset is about to run out. |
| Macro aborted | Macro | The execution of a macro has failed. |
| Macro completed | Macro | The execution of a macro has been completed normally. |
| Macro started | Macro | The execution of a macro has begun. |
| Main database lost | Directory Manager role | The health event generated when the Directory database is lost. |
| Main database recovered | Directory Manager role | The health event generated when the Directory database has been recovered. |
| Manual station activated | Door | Someone has pulled the door emergency release (manual pull station). |
| Manual station reverted to normal state | Door | The door emergency release (manual pull station) has been restored to it normal operating position. |
| Maximum occupancy exceeded | Area | The number of people in the area now exceeds the maximum occupancy limit. |
| Maximum occupancy reached | Area | The number of people in the area has reached the maximum occupancy limit. |
| Memory usage high | Server | The health event generated when the memory usage rises above the high threshold configured in the Health Monitor role's Properties page for this event. |
| Memory usage normal | Server | The health event generated when the memory usage drops below the normal threshold configured in the Health Monitor role's Properties page for this event. |
| Missing tail host | Door | The tail host of a two-host visitor delegation did not badge. |
| Motion | Camera | There is motion detected. |
| Motion off | Camera | This event is issued following a Motion on event when motion (measured in terms of number of motion blocks) has dropped below the “motion off threshold” for at least 5 seconds. |
| Motion on | Camera | This event is issued when positive motion detection has been made. |
| Multiple units are configured for the interlock | Area | All doors that are part of an interlock configuration must be controlled by the same unit. |
| Mustering ended | Area | An evacuation has ended and people are no longer evacuating to the area. This event is generated from the Evacuation Assistant plugin only occurs for the last evacuation to the area. |
| Mustering started | Area | An evacuation is in progress and people are evacuating to the area. This event is generated from the Evacuation Assistant plugin and only occurs for the first evacuation to the area. |
| No entry detected | Cardholder or door | A cardholder was granted access to a door or area, but no entry is detected. For this event to be generated, you must configure a door sensor on the door side where you want entry to be detected. |
| No match | ALPR unit, hotlist | A vehicle has not been matched to the hotlist associated to the Sharp unit. |
| No RTP packet lost in the last minute | Camera | The Archiver has received all the RTP packets in the last minute. |
| Object condition changed | Camera (video analytics) | An object has suddenly changed direction or speed, such as when a person starts running or slips. |
| Object count changed | Camera (video analytics) | A change has been detected in the object count on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Object count reached | Camera (video analytics) | An object count limit has been reached for the object count on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Object crossed line | Camera (video analytics) | An object has crossed a predefined tripwire. |
| Object detected | Camera (video analytics) | An object is in the camera field of view. |
| Object detected in field | Camera (video analytics) | An object has been detected in a zone that is being monitored for intrusion on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Object direction changed | Camera (video analytics) | An object has been detected changing direction on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Object entered | Camera (video analytics) | An object has entered the camera field of view. |
| Object exited | Camera (video analytics) | An object has exited the camera field of view. |
| Object following route | Camera (video analytics) | An object is following a predetermined route, in a specific direction. |
| Object left | Camera (video analytics) | An object has entered and exited the camera field of view. |
| Object merged | Camera (video analytics) | Two separate objects in the camera field of view have merged. |
| Object removed | Camera (video analytics) | An object has been removed from the camera field of view. |
| Object separated | Camera (video analytics) | An object within the camera field of view has separated into two objects. |
| Object stopped | Camera (video analytics) | A moving object has stopped. |
| Object velocity changed | Camera (video analytics) | An object has been detected changing speed on a camera monitored by KiwiVision Video Analytics or equipped with similar capabilities. |
| Offload failed | ALPR Manager, Patroller | An offload from Patroller to Security Center has failed. |
| Offload successful | ALPR Manager, Patroller | An offload from Patroller to Security Center was successful. |
| Paid time started | Parking rule | Parking time has been purchased through connected pay stations or mobile apps. |
| Parking zone capacity threshold reached | Parking zone | The parking zone capacity has reached the capacity threshold that is defined in the ALPR Manager. |
| People count reset | Area | The number of people counted in an area has been reset to 0. |
| People counting | Camera (video analytics) | The people count on a camera has been updated. This event works differently
depending on which software module generates it.
|
| People counting alarm | Camera (video analytics) | The people count for a video analytics rule has reached the configured threshold. The configuration of the thresholds and rules is done from the unit's web page. |
| Person added to area | Area | A person has been added to an area. |
| Person falling | Camera (video analytics) | A person falling has been detected in the camera. |
| Person removed from area | Area | A person has been removed from an area. |
| Person running | Camera (video analytics) | A person running has been detected in the camera. |
| Person sliding | Camera (video analytics) | A person sliding has been detected in the camera. |
| Playback bookmark added | Camera | A user has added a bookmark to a recorded video. |
| Protection threshold exceeded | Archiver or Auxiliary Archiver role | The Protected video threshold configured from the Archiver has been exceeded. You can monitor the percentage of disk space occupied by protected video files from the Statistics page in the Archiver's Resources tab in Config Tool. |
| PTZ activated | Camera (PTZ) | A user started using the PTZ after it has been idle. The field indicates the user who activated the PTZ. This event is regenerated every time a different user takes control of the PTZ, even when the PTZ is still active. |
| PTZ locked | Camera (PTZ) | A user has tried to move the PTZ while it is being locked by another user with a higher PTZ priority. The field indicates the machine, application type, and user who currently holds the lock. |
| PTZ stopped | Camera (PTZ) | The PTZ has not been manipulated by any user after a predetermined period of time. The field indicates the user who last used the PTZ. |
| PTZ zoom started | Camera (PTZ) | A user started zooming the PTZ. The event description indicates the user who performed the zoom. Subsequent PTZ zoom by user events are generated if another user zooms the PTZ, or if the original user zooms the PTZ after the Idle delay has expired. |
| PTZ zoom stopped | Camera (PTZ) | The PTZ has not been zoomed by any user after a predetermined period of time. The field indicates the user who last zoomed the PTZ. |
| Receiving RTP packets from multiple sources | Camera | The Archiver is receiving more than one video stream for the same camera. IMPORTANT: When this rare situation arises, the Archiver cannot tell which
stream is the correct stream by looking at the source IP address because of the
NAT (Network Address Translation), so an arbitrary choice is made. This can result
in the wrong video stream being archived. However, the source IP address and port
number of both streams are indicated in the event description, and the two sources
are labeled Archived and Rejected. You can find the faulty unit that
is causing this conflict.
|
| Reconnected to Cloud Storage | Archiver role | The connection between the Archiver role and the Cloud Storage is reestablished. |
| Record fusion events: <Record type> | (Not applicable) | A record of type <Record type> has been added. NOTE: You must select
a <Record type> child event. The Record fusion events on its own
is not a valid event.
|
| Record updated | (Typically an area, but can be any type of entity) | This event is raised by the Record Fusion Service when an event with contextual information linked to a record type is triggered in the system, such as when data is ingested through the Record Caching Service role. |
| Record cache ingestion failed | Record Caching Service role | An operation to import data into a record cache, triggered by one of the Ingest actions, has ended with an error. Partial data might have been saved. See Ingest event, Ingest file, and Ingest from web request in Action types. |
| Record cache ingestion finished | Record Caching Service role | An operation to import data into a record cache, triggered by one of the Ingest actions, has completed successfully. |
| Record cache ingestion started | Record Caching Service role | An operation to import data into a record cache, triggered by one of the Ingest actions, has started. |
| Recording problem | Camera | There is a problem recording the camera. The problem might be due to an error writing to disk, an error writing to the Archiver database, or the fact that the camera is not streaming video when it should. |
| Recording started (alarm) | Camera | The recording on a camera has been started as the result of an alarm being triggered. |
| Recording started (continuous) | Camera | The recording on a camera has been started by a continuous archiving schedule. |
| Recording started (external) | Camera | The recording on a camera has been started by the Start recording action. This action could have been triggered by another event or run from a macro. |
| Recording started (motion) | Camera | The recording on a camera has been started through motion detection. |
| Recording started (user) | Camera | The recording on a camera has been started manually by a user. |
| Recording stopped (alarm) | Camera | The recording on a camera has stopped because the alarm recording time has elapsed. |
| Recording stopped (continuous) | Camera | The recording on a camera has stopped because it is no longer covered by a continuous archiving schedule. |
| Recording stopped (external) | Camera | The recording on a camera has been stopped by the Stop recording action. This action could have been triggered by another event or run from a macro. |
| Recording stopped (motion) | Camera | The recording on a camera has stopped because the motion has ceased. |
| Recording stopped (user) | Camera | The recording on a camera has been stopped manually by a user. |
| Remaining archive disk space low | Archiver or Auxiliary Archiver role | The health event generated when the archiving disk space usage rises above the threshold configured in the Health Monitor role's Properties page for this event. |
| Remaining archive disk space normal | Archiver or Auxiliary Archiver role | The health event generated when the archiving disk space usage drops below the threshold configured in the Health Monitor role's Properties page for this event. |
| Request to exit | Door | Someone has pressed the door release button or has triggered a request to exit motion detector. The Request to exit event has special filtering to make this feature compatible with motion detection request to exit hardware. Set these properties in the tab. |
| Request to exit normal | Door | No request to exit is being made. |
| Retrieving archives from units failed | Archiver role or officer | The health event generated when the retrieval of video archives from wearable cameras has failed. |
| Retrieving archives from units partially failed | Archiver role or officer | The health event generated when the retrieval of video archives from some of the wearable cameras has failed. |
| Retrieving archives from units succeeded | Archiver role or officer | The health event generated when the retrieval of video archives from wearable cameras has succeeded. |
| Role started | Any role | The health event generated when a role starts. |
| Role stopped by user | Any role | The health event generated when a role is stopped by a user. |
| Role stopped unexpectedly | Any role | The health event generated when a role is stopped unexpectedly. For example, the role crashed. |
| RTP packet loss high | Officer or Security Desk | The health event generated when the ratio of lost RTP packets rises above the threshold configured in the Health Monitor role's Properties page for this event. |
| RTP packet loss normal | Officer or Security Desk | The health event generated when the ratio of lost RTP packets drops below the threshold configured in the Health Monitor role's Properties page for this event. |
| RTP packets lost | Camera | There are RTP packets that the Archiver never received. This could happen if the packets have been lost on the network, or if the Archiver does not have enough CPU to process all the packets received on the network card. The field indicates the number of packets lost since the last time that this event was issued (no more than once every minute). |
| Scheduled controlled access | Elevator | The schedule for controlled access to elevator floors now applies. |
| Scheduled free access | Elevator | The schedule for free access to elevator floors now applies. |
| Scheduled lock | Door | The door unlock schedule has expired. The lock is now re-asserted ( thedoor is locked). |
| Scheduled unlock | Door | The door lock is unlocked due to a programmed unlock schedule. |
| Schedule unlock ignored: first-person-in rule supervisor absent | Door | The door unlock schedule is ignored because the restriction imposed by the first-person-in rule has not yet been satisfied. |
| Server started | Server | The health event generated when a Genetec™ Server service starts. |
| Server stopped by user | Server | The health event generated when a Genetec™ Server service is stopped by a user. |
| Server stopped unexpectedly | Server | The health event generated when a Genetec™ Server service is stopped unexpectedly. |
| Session completed | Parking zone | The vehicle has exited the parking zone. |
| Session started | Parking zone | The vehicle has entered the parking zone. |
| Signal lost | Camera | The coaxial camera signal is lost. |
| Signal recovered | Camera | The coaxial camera signal is recovered. |
| Signed token creation is ready | Directory role | The health event generated when the system successfully created a token for authentication. |
| Supervisor in: access rule activated | Door | The first-person-in rule is enforced on an area, and a supervisor has badged in, allowing all cardholders with the correct access rights to enter the area. |
| Supervisor in: unlocking schedule activated | Door | The first-person-in rule is enforced on an area, and a supervisor has badged in, allowing anyone to enter the area. |
| Synchronization completed: External system | Active Directory role | The synchronization of an external system has completed. |
| Synchronization error: External system | Active Directory role | The synchronization of an external system has resulted in an error. |
| Synchronization failed | Active Directory role | The health event generated when the synchronization of an Active Directory has failed. |
| Synchronization partially completed due to some conflicts: External system | Active Directory role | The synchronization of an external system was only partially completed. |
| Synchronization recovered | Active Directory role | The health event generated when the synchronization of an Active Directory has recovered. |
| Synchronization started: External system | Active Directory role | The synchronization of an external system has started. |
| Tailgating | Camera (video analytics) | Two people have entered a secured area following each other closely. |
| Temperature alarm | Video unit | The temperature of the video unit has risen above the safety level. |
| Temperature detection alarm | Camera | The detected temperature has reached the configured threshold. This event is only available for cameras equipped with a temperature sensor, such as certain Axis and Hanwha models. The region of the image where high temperature is detected is indicated in the event description. |
| Temperature detection alarm off | Camera | The detected temperature is lower than a predefined threshold. This event is only available for cameras equipped with a temperature sensor, such as certain Axis and Hanwha models. |
| Temperature detection alarm on | Camera | The detected temperature is higher than a predefined threshold. This event is only available for cameras equipped with a temperature sensor, such as certain Axis and Hanwha models. |
| Threat level cleared | Threat level | A threat level has been cleared. |
| Threat level set | Threat level | A threat level has been set. |
| Transmission lost | Camera | The Archiver is still connected to the camera, but it has not received any video packets for more than 5 seconds. |
| Transmission recovered | Camera | The Archiver has started to receive video packets from the camera again. |
| Undefined video analytics event | Camera (video analytics) | A generic video analytic event has been issued, but it is not yet mapped to a
Security Center event. Tip: You can check for more sub-type information
in the analytic metadata.
|
| Unit connected | Unit | The connection to a unit has been established or restored. |
| Unit failed to respond to edge video request | Camera | Event related to a camera that is recording directly on the unit. |
| Unit lost | Unit | The connection to a unit has been lost. |
| Unit replaced | Camera | A new camera replaced an existing camera. |
| Unit synchronization failed | Access control unit | The synchronization of the unit with the Access Manager has failed. |
| Unit synchronization started | Access control unit | The synchronization of the unit with the Access Manager has started. |
| Unit synchronization succeeded | Access control unit | The synchronization of the unit with the Access Manager has completed successfully. |
| Unit time in sync with time server | Video unit | The health event generated when the unit time is in sync with the time server. |
| Unit time out of sync with time server | Video unit | The health event generated when the unit time is out of sync with the time server. |
| Unit warning activated | Access control unit | The Synergis Cloud Link unit has gone into a warning state. The reason for the warning is detailed in the event description. |
| Unit warning deactivated | Access control unit | The Synergis Cloud Link unit is no longer in a warning state. The latest reason for the warning is detailed in the event description. |
| Update failed | Patroller, Mobile Sharp | An update on Patroller or a Mobile Sharp unit has failed, or a file could not be synchronized on a Patroller computer. |
| Update installation completed | Patroller, Mobile Sharp | An update has been completed on Patroller or a Mobile Sharp unit, and no reboot is required. |
| Update installation started | Patroller, Mobile Sharp | A user has started an update on Patroller by clicking the “Update” icon. |
| Update published | Patroller, Mobile Sharp | An update has been processed, and is ready to be deployed to Patroller. |
| Update uninstallation completed | Patroller, Mobile Sharp | A rollback on Patroller or a Mobile Sharp unit has been completed. |
| Update uninstallation started | Patroller, Mobile Sharp | A user has started a rollback on Patroller by clicking the “Rollback” icon. |
| Upgrade canceled | Access control unit | A firmware upgrade on an access control unit has been canceled. |
| User logged off | User | A user has logged off of a Security Center application. |
| User logged on | User | A user has logged on to a Security Center application. |
| User logon failed | User | User logon attempt failed. |
| Validating paid time | Parking rule | The convenience time or the paid time has expired for the parking session. |
| Video signal lost | Camera | The health event generated when the camera signal has been lost. |
| Video signal recovered | Camera | The health event generated when the camera signal has been recovered. |
| Violation detected | Parking rule | The convenience time, the grace period, or the paid time has expired for the parking session. |
| Violation enforced | Parking rule | The vehicle in violation has been ticketed. |
| Visitor astray | Door | A visitor did not badge within the allotted time after the delegation's host or a previous visitor. |
| VRM connection attempt | Archiver role | The Archiver has attempted to connect to a VRM unit. |
| VRM connection failure | Archiver role | The Archiver has failed to connect to a VRM unit. |
| Window closed | Zone | A physical window has closed. |
| Window opened | Zone | A physical window has opened. |
| Zone armed | Zone | A zone has been armed. |
| Zone disarmed | Zone | A zone has been disarmed. |
| Zone maintenance completed | I/O zone | An I/O zone has been taken out of maintenance mode. |
| Zone maintenance started | I/O zone | An I/O zone has been put into maintenance mode. |
| Zone offline | I/O zone | An I/O zone is offline. |
| Zone online | I/O zone | An I/O zone is online. |
For a list of events that you can monitor in Security Desk for KiwiVision™ modules, see this topic on the TechDoc Hub.