Event types - Security Center 5.10

Security Center User Guide 5.10

Applies to
Security Center 5.10
Last updated
2023-05-02
Content type
Guides > User guides
Language
English
Product
Security Center
Version
5.10

All events in Security Center are associated with a source entity, which is the main focus of the event.

Security Center supports the following event types:
Event Source entity Description
A door of an interlock has an unlock schedule configured area A door that is part of an interlock configuration has an unlock schedule configured.
A door of an interlock is in maintenance mode area A door that is part of an interlock configuration is in maintenance mode.
Ability to write on a drive as been restored Archiver or Auxiliary Archiver role Ability to write on a drive has been restored.
AC fail access control unit or intrusion detection unit AC (alternating current) has failed.
Access denied cardholder, credential, door, or elevator A cardholder is denied access (any reason).
Access denied: A second cardholder is required door Two cardholders must present their credentials within a certain delay of each other and the delay has expired. This event only applies to doors controlled by Synergis™ units.
Access denied: Antipassback violation door A cardholder requested access to an area that they have already entered, or requested access to leave an area that they were never in.
Access denied: Card and PIN timeout door or elevator A card and PIN are required to enter an area, and the cardholder did not enter the PIN within the allotted time.
Access denied: Companion was denied door or elevator Two-person rule is enforced, and one of the cardholders was denied access.
Access denied: Denied by access rule door or elevator The cardholder is denied access according to the access rule.
Access denied: Escort not supported by this unit model door or elevator The visitor escort rule is enforced on an area, but the unit controlling its doors does not support this feature.
Access denied: Expired credential cardholder, credential, door, or elevator An expired credential has been used.
Access denied: First-person-in rule supervisor absent door or elevator The first-person-in rule has been enforced on the area, and no supervisor has arrived yet.
Access denied: Host is required door or elevator The visitor escort rule is enforced and the visitor badged before the host.
Access denied: Inactive cardholder cardholder, door, or elevator A cardholder with an inactive profile has attempted to access a door or elevator.
Access denied: Inactive credential cardholder, credential, door, or elevator A credential with an inactive profile has been used.
Access denied: Insufficient privileges door or elevator The cardholder is denied access because they do not have the required security clearance. This event only applies to doors controlled by Synergis™ units.
Access denied: Interlock door Access is denied because of an interlock constraint.
Access denied: Invalid PIN door or elevator The cardholder entered an invalid PIN.
Access denied: Lost credential cardholder, credential, door, or elevator A credential that has been declared as lost has been used.
Access denied: Max occupancy reached door or elevator The cardholder is denied because the area is at its occupancy limit.
Access denied: No access rule assigned door or elevator The cardholder is denied access because they are not assigned any access rights.
Access denied: Out of schedule door or elevator The access rule associated with this cardholder does not apply during the date or time specified in the schedule.
Access denied: Stolen credential cardholder, credential, door, or elevator A credential that has been declared as stolen has been used.
Access denied: Unassigned credential credential, door, or elevator A credential that has not been assigned to a cardholder has been used.
Access denied: Unknown credential door or elevator A credential that is unknown in the Security Center system has been used.
Access denied: Valid card, inactive PIN door or elevator A card and PIN are required to enter an area, and the cardholder entered an inactive PIN.
Access denied: Valid card, invalid PIN door or elevator A card and PIN are required to enter an area, and the cardholder entered an invalid PIN.
Access granted cardholder, door, or elevator Access has been granted through a door to a cardholder according to the access rules governing the door, elevator, or area. For a perimeter door of an interlock: When an authorized cardholder accesses a door of an interlock, Security Center might generate an Access granted event for the door even though the door does not unlock (due to another perimeter door already being open).
Adaptive motion triggered camera (video analytics) Motion has been detected on a camera equipped with video analytics capabilities.
Agent started Wearable Camera Manager role Health event generated when a role agent starts.
Agent stopped Wearable Camera Manager role Health event generated when a role agent stops.
Agent stopped unexpectedly Wearable Camera Manager role Health event generated when a role agent stops unexpectedly.
Alarm acknowledged alarm An alarm has been acknowledged by a user, or auto-acknowledged by the system.
Alarm acknowledged (alternate) alarm An alarm has been acknowledged by a user using the alternate mode.
Alarm being investigated alarm An alarm with a acknowledgment condition that is still active has been put into the under investigation state.
Alarm condition cleared alarm The acknowledgment condition of an alarm has been cleared.
Alarm context changed alarm The Context field of an alarm has been edited by a user.
Alarm forcibly acknowledged alarm An alarm has been forcibly acknowledged by a user with special privileges.
Alarm trigger rate high Directory role Health event generated when the alarm trigger rate rises above the high threshold configured in the Health Monitor role's Properties page for this event.
Alarm trigger rate normal Directory role Health event generated when the alarm trigger rate drops below the normal threshold configured in the Health Monitor role's Properties page for this event.
Alarm triggered alarm An alarm has been triggered.
An interlock cannot be in hard antipassback mode area An interlock cannot be in hard antipassback mode. This is an illegal configuration.
An interlock cannot have a perimeter door with no door sensor configured area Interlock cannot be enforced if the system cannot tell whether a door is open or not.
An interlock cannot have only one perimeter door area You need at least two perimeter doors for interlock to be applied.
Antipassback disabled: Invalid settings area Antipassback disabled: Invalid settings.
Antipassback disabled: Not supported when unit is not in server mode area Units have not been set to server mode. Antipassback is available according to the unit’s operating mode. For more information about unit limitations, see Limitations in Security Center.
Antipassback violation area, cardholder, or visitor An access request was made to enter an area with a credential that is already inside the area, or to exit an area with a credential that was never in the area.
Antipassback violation forgiven cardholder or visitor A security operator has granted access to a cardholder responsible for a passback violation.
Application connected Security Desk Health event generated when a user connects to the Directory through Security Desk.
Application disconnected by user Security Desk Health event generated when a user disconnects his Security Desk from the Directory.
Application disconnected unexpectedly Security Desk Health event generated when a Security Desk application is disconnected from the Directory, but not by the user (network issue or application crash).
Application lost application or role An application or a role has lost its connection to the Directory.
Application started Security Desk Health event generated when a Security Desk application starts.
Application stopped Security Desk Health event generated when a Security Desk application is stopped manually. Stopping Security Desk and disconnecting it from the Directory are not necessarily done at the same time. For example, Security Desk can run without being connected to the Directory.
Application stopped unexpectedly Security Desk Health event generated when a Security Desk application is stopped unexpectedly, for example, by a crash.
Archive backup failed Archiver role or camera Health event generated when a Backup archive transfer operation failed.
Archive backup succeeded Archiver role or camera Health event generated when a Backup archive transfer operation succeeded.
Archive duplication canceled Archiver role or camera Health event generated when a Duplicate archives archive transfer operation is canceled.
Archive folder path is too long Archiver or Auxiliary Archiver role The disk base path for video archives has exceeded the maximum length permitted by the operating system.
Archive transfer sequence imported camera A new video sequence is made available for use in the Archiver. The type of transfer and the start and end time of the imported sequence is shown in the description. The possible transfer types are:
  • Consolidation
  • Duplicate
  • Import (for offline device)
  • EdgeTrickling
Archiving disk changed Archiver or Auxiliary Archiver role The Allotted space on one of the disks assigned for archive storage for this Archiver has been used up, and the Archiver has switched to the next disk in line. The names of the previous disk and current disk are indicated in the Description field.
Archiving queue full camera A camera (video encoder) is streaming video faster than the Archiver is able to write the video packets to disk. A problem with the Archiver database also triggers this event. The name of the camera whose packets are lost is indicated in the Description field.
Archiving started Archiver or Auxiliary Archiver role Health event generated when the Archiver role is ready to archive video.
Archiving stopped Archiver or Auxiliary Archiver role Archiving has stopped because the disks allocated for archiving are full. This event always accompanies a Disk full event.
Asset moved asset An asset has been moved.
Asset offline asset The RFID tag of an asset has gone offline.
Asset online asset The RFID tag of an asset has been put online.
Audio alarm camera A sound has been picked up by a microphone associated with a camera.
Audio analytics event camera (video analytics) An audio analytics event has been detected on a camera equipped with audio analytics capabilities.
Badge printing job canceled cardholder or visitor A user has canceled a badge printing job.
Badge printing job completed cardholder or visitor A user has completed a badge printing job.
Badge printing job queued cardholder or visitor A user has queued a badge printing job.
Battery fail access control unit or intrusion detection unit The unit battery has failed.
Below max occupancy area Number of people in the area has dropped under the maximum occupancy limit.
Block camera started camera A user has blocked a video stream from other users in the system.
Block camera stopped camera A user has unblocked a video stream from other users in the system.
Camera recording problem camera Health event generated when the camera is not able to record its video.
Camera recording recovered camera Health event generated when the camera is able to record again.
Camera tampering camera (video analytics) A dysfunction has occurred, potentially due to camera tampering, resulting in a partial or complete obstruction of the camera view, a sudden change of the field of view, or a loss of focus.
Cannot write on the specified location Archiver or Auxiliary Archiver role The Archiver cannot write to a specific drive. The path to the drive is indicated in the Description field.
Cannot write to any drive Archiver or Auxiliary Archiver role The Archiver is unable to write to any of the disk drives. This situation can arise for the following reasons: When write accesses to shared drives are revoked. When shared drives are inaccessible. When shared drives no longer exist. When this happens, archiving is stopped. The Archiver re-evaluates the drive status every 30 seconds.
Certificate error access control and video unit Health event generated by the Unit Assistant role when there is a problem with the certificate of the unit it manages.
Certificate valid access control and video unit Health event generated by the Unit Assistant role when the certificate is valid after having a warning or an error.
Certificate warning access control and video unit Health event generated by the Unit Assistant role when the certificate has a non-critical issue. For example, when the certificate is about to expire.
Connection failed AD role, Federation™ role, or GCS role Health event generated when the role is not able to connect to the remote component.
Connection restored AD role, Federation™ role, or GCS role Health event generated when the role is able to connect to the remote component again.
Connection to camera established camera Health event generated when the Archiver role connects to the camera.
Connection to camera stopped by user camera Health event generated when the Archiver role disconnects from the camera through a user action. For example, role stopped by the user.
Connection to camera stopped unexpectedly camera Health event generated when the disconnection of the Archiver role from the camera is not intentional. For example, the role crashed, network disconnection, and so on.
Connection to unit established unit Health event generated when the role connects to the unit.
Connection to unit stopped by user unit Health event generated when the role disconnects from the unit through a user action. For example, role stopped by the user.
Connection to unit stopped unexpectedly unit Health event generated when the disconnection of the role from the unit is not intentional. For example, the role crashed, network disconnection, and so on.
Convenience time started parking rule The convenience time portion of the parking session has begun.
CPU usage high server Health event generated when the CPU usage of the server rises above the threshold configured in the Health Monitor role's Properties page for this event.
CPU usage normal server Health event generated when the CPU usage of the server drops below the threshold configured in the Health Monitor role's Properties page for this event.
Crowd detected camera (video analytics) A crowd or queue has been detected on a camera equipped with video analytics capabilities.
Custom event (system-wide) A custom event is an event added after the initial system installation. Events defined at system installation are called system events. Custom events can be user-defined or automatically added through plugin installations. Unlike system events, custom events can be renamed and deleted.
Database automatic backup failed Directory role Health event generated when the backup and restore feature is not working.
Database automatic backup restored Directory role Health event generated when the backup and restore feature was successful.
Database lost Any role using a database The connection to the role database was lost. If this event is related to a role database, it might be because the database server is down or cannot be reached by the role server. If the event is related to the Directory database, the only action you can use is Send an email because all other actions require a working connection the Directory database.
Database recovered Any role using a database The connection to the role database has been recovered.
Database restore failed Directory Manager role Health event generated when the Directory database failover backup and restore feature failed.
Database restore succeeded Directory Manager role Health event generated when the Directory database failover backup and restore feature was successful.
Database space low Any role using a database Health event generated when the available disk space drops below the threshold configured in the Health Monitor role's Properties page for this event.
Database space normal Any role using a database Health event generated when the available disk space rises above the threshold configured in the Health Monitor role's Properties page for this event.
Deadbolt locked zone The deadbolt on a door has been locked.
Deadbolt unlocked zone The deadbolt on a door has been unlocked.
Direction alarm camera (video analytics) A direction alarm has been triggered on a camera equipped with video analytics capabilities.
Directory started Directory role Health event generated when the Directory role starts. This can only happen if you have more than one Directory server.
Directory stopped by user Directory role Health event generated when the Directory role does a clean shutdown. For example, when Genetec™ Server is stopped in Windows services.
Directory stopped unexpectedly Directory role Health event generated when the Directory role stopped unintentionally. For example, during a server crash.
Disk access restored Archiver or Auxiliary Archiver role The role regained access to its disks.
Disk access unauthorized Archiver or Auxiliary Archiver role The role is not able to access its disks.
Disk load threshold exceeded Archiver or Auxiliary Archiver role The disk space allocated for archiving has exceeded its load threshold (default=90%). This is caused by under-evaluating the disk space required, or by another application that is taking more disk space than it should. If 100% of the allotted disk space is used, the Archiver starts to delete old archive files prematurely to free disk space for new archive files, starting with the oldest files.
Disks full Archiver or Auxiliary Archiver role All disks allotted for archiving are full and the Archiver is unable to free disk space by deleting existing video files. This event can occur when another application has used up all the disk space reserved for Security Center, or when the Delete oldest files when disks full option is not selected in the Server Admin. When this happens, archiving is stopped. The Archiver re-evaluates the disk space every 30 seconds.
Door closed door The door has closed. For this event to be generated, the door must be equipped with a door sensor.
Door forced open door The door is locked but the door sensor indicates that the door is open.
Door locked door The door is considered locked in Security Center.
Door maintenance completed door The door has been taken out of maintenance mode.
Door maintenance started door The door has been put into maintenance mode.
Door manually unlocked door In Security Desk, a user has manually unlocked a door.
Door offline: Device is offline door One or more devices associated to this door has gone offline.
Door online door The door is back online after being offline.
Door opened door The door has opened. For this event to be generated, the door must be equipped with a door sensor.
Door open too long door The door has been held open for too long. To enable this event, you must set the Trigger event to ON in the Door held section of the door's Properties page in Config Tool.
Door secured door The door has been properly closed and locked after a Door unsecured event. For this event to be generated, the door must be equipped with a door sensor, a door lock, and a lock sensor.
Door test completed successfully door The door test has been completed successfully.
Door test failed door The door test has failed.
Door test failed: Aborted door The door test has been aborted.
Door test failed: Canceled because door is unsecured door The door test has been canceled because the door is not secured.
Door test failed: Canceled because of shunted readers door The door test has been canceled because readers are shunted.
Door test failed: Door failed to relock door The door test has failed because the door did not relock.
Door test failed: Door failed to unlock door The door test has failed because the door did not unlock.
Door test failed: Error occurred door The door test has failed because an error occurred.
Door test started door The door test has started.
Door unlocked door The door has been unlocked.
Door unsecured door The door has been unlocked, but the door lock indicates that the door is locked. For this event to be generated, the door must be equipped with a door sensor, a door lock, and a lock sensor.
Doorknob in place zone The doorknob is in place and the door is closed.
Doorknob rotated zone The doorknob has rotated.
Double-badge off cardholder, credential, or door The door has been locked and an associated event has stopped.
Double-badge on cardholder, credential, or door The door has been unlocked and an associated event has been triggered.
Duplicating archives failed Archiver role or camera Health event generated when a Duplicate archives archive transfer operation failed.
Duplicating archives partially failed Archiver role or camera Health event generated when a Duplicate archives archive transfer operation failed half-way through.
Duplicating archives succeeded Archiver role or camera Health event generated when a Duplicate archives archive transfer operation succeeded.
Duplicating archives will retry Archiver role or camera Health event generated when a Duplicate archives archive transfer operation failed but will retry later.
Duress PIN entered cardholder or door A cardholder entered a duress PIN at a door.
Edge storage medium failure camera or video unit After a unit was restarted, the video that was recorded on the edge could not be accessed.
Elevator offline: Device is offline elevator One or more devices associated to this elevator has gone offline.
End of camera tampering camera (video analytics) A dysfunction, which might have been caused by camera tampering, has been resolved.
Entity has expired cardholder or credential A credential or its associated cardholder has expired (its status is now Expired).
Entity is expiring soon credential Security Center generates this event to warn you that the expiry date of an entity is approaching. The number of days of advance warning provided by this event must be set.
Entity is offline server, role, or unit Health event generated when an entity goes offline (red).
Entity is online server, role, or unit Health event generated when an entity is back online (black).
Entity warning any entity A health warning has been issued for this entity.
Entry assumed cardholder or door A cardholder was granted access to a door or area, and it is assumed that they entered because no door sensor is configured.
Entry detected cardholder or door A cardholder was granted access to a door or area, and their entry is detected. For this event to be generated, you must configure an entry sensor on the door side where you want entry to be detected. If no Entry Sensors are configured on the door, the event will be generated based on the Door Sensor input.
Evacuation ended area An evacuation from the area has ended. This event is generated from the Evacuation Assistant plugin.
Evacuation started area An evacuation from the area has been started. This event is generated from the Evacuation Assistant plugin.
Face detected camera (video analytics) A face has been detected on a camera equipped with video analytics capabilities.
Face recognized camera (video analytics) A face on a hotlist has been recognized by a camera equipped with video analytics capabilities.
Failed to create a signed token Directory role Health event generated when the system cannot generate a token for authentication.
File deleted camera A video file associated to a camera has been deleted because the retention period has ended, or the archive storage disk was full.
Firmware upgrade canceled access control unit A firmware upgrade on an access control unit has been canceled.
Firmware upgrade failed access control unit A firmware upgrade on an access control unit has failed.
Firmware upgrade scheduled access control unit A firmware upgrade on an access control unit has been scheduled.
Firmware upgrade started access control unit A firmware upgrade on an access control unit has started.
Firmware upgrade succeeded access control unit A firmware upgrade on an access control unit has completed successfully.
First person in area A cardholder has entered an empty area.
Floor accessed elevator An elevator floor button has been pressed.
Glass break zone Glass has broken.
Hardware tamper access control unit, door, elevator, or zone The tamper input on a unit has been triggered.
Health event Health monitor role A health event has occurred.
Heat map changed camera (video analytics) A change has been detected in a heat map area on a camera equipped with video analytics capabilities.
Input alarm activated input on intrusion detection unit The input has entered an alarm state.
Input alarm restored input on intrusion detection unit The input has left an alarm state.
Input bypassed input on intrusion detection unit The input has entered a bypassed state.
Input bypass restored input on intrusion detection unit The input has left a bypassed state.
Input state changed: Input active input on camera, access control unit, or intrusion detection unit The input has entered an active state.
Input state changed: Input normal input on camera, access control unit, or intrusion detection unit The input has entered a normal state.
Input state changed: Input trouble input on access control unit or intrusion detection unit The input has entered a trouble state.
Input trouble - open access control or intrusion detection unit Supervised input has entered a trouble state (open circuit).
Input trouble - short access control or intrusion detection unit Supervised input has entered a trouble state (short circuit).
Interface module AC fail state active door The AC (alternating current) of an interface module has failed.
Interface module AC fail state restored door The AC (alternating current) of an interface module has been restored.
Interface module battery fail state active door The battery of an interface module has failed.
Interface module battery fail state restored door The battery of an interface module has been restored.
Interface module firmware upgrade canceled access control unit A firmware upgrade on an interface module has been canceled.
Interface module firmware upgrade failed access control unit A firmware upgrade request has failed, or there are firmware upgrades past their scheduled start time after the Access Manager role is restarted.
Interface module firmware upgrade package transfer started access control unit A firmware upgrade request has been sent to the Synergis™ Cloud Link unit.
Interface module firmware upgrade scheduled access control unit A firmware upgrade on an interface module has been scheduled.
Interface module firmware upgrade started access control unit A firmware upgrade on an interface module has started.
Interface module firmware upgrade succeeded access control unit A firmware upgrade on an interface module has succeeded.
Interface module offline access control unit The interface module has gone offline.
Interface module online access control unit The interface module has come online.
Interface module tamper state active door The tamper input of an interface module has been triggered.
Interface module tamper state restored door The tamper input of an interface module has returned to normal.
Interlock is not supported by the unit area Interlock is enabled on an area but the access control unit controlling the doors does not support this feature.
Interlock lockdown input active area Interlock lockdown has been turned on.
Interlock lockdown input normal area Interlock lockdown has been turned off.
Interlock override input active area Interlock override is on.
Interlock override input normal area Interlock override is off.
Intrusion alarm silenced intrusion detection area Intrusion alarm has been silenced.
Intrusion detection area alarm activated intrusion detection area Intrusion detection area alarm activated.
Intrusion detection area arming intrusion detection area Intrusion detection area is being armed.
Intrusion detection area arming postponed intrusion detection area Intrusion detection area arming is postponed.
Intrusion detection area canceled alarm intrusion detection area Intrusion detection area alarm is canceled.
Intrusion detection area canceled postponed request intrusion detection area Intrusion detection area postponed request is canceled.
Intrusion detection area disarm request intrusion detection area Intrusion detection area postponed request is canceled.
Intrusion detection area disarmed intrusion detection area Intrusion detection area is disarmed.
Intrusion detection area duress intrusion detection area Intrusion detection area is disarmed with duress.
Intrusion detection area entry delay activated intrusion detection area Intrusion detection area entry delay activated.
Intrusion detection area forced arming intrusion detection area Intrusion detection area is forcefully armed.
Intrusion detection area input bypass activated intrusion detection area Intrusion detection area input bypass is activated.
Intrusion detection area input bypass deactivated intrusion detection area Intrusion detection area input bypass is deactivated.
Intrusion detection area input trouble intrusion detection area Intrusion detection area input trouble.
Intrusion detection area master arm request intrusion detection area Intrusion detection area master arm request is issued.
Intrusion detection area master armed intrusion detection area Intrusion detection area is master armed.
Intrusion detection area perimeter arm request intrusion detection area Intrusion detection area perimeter arm request is issued.
Intrusion detection area perimeter armed intrusion detection area Intrusion detection area is perimeter armed.
Intrusion detection area postponed arming request intrusion detection area Intrusion detection area arming request is postponed.
Intrusion detection unit input bypass activated intrusion detection unit Intrusion detection unit input bypass is activated.
Intrusion detection unit input bypass deactivated intrusion detection unit Intrusion detection unit input bypass is deactivated.
Intrusion detection unit input trouble intrusion detection unit Intrusion detection unit input trouble.
Intrusion detection unit tamper intrusion detection unit Intrusion detection unit has been tampered with.
Invalid configuration in unit video unit The configuration of the unit is invalid.
Invalid custom encryption values Archiver or Auxiliary Archiver role This warning is issued by the Archiver on start-up and every 5 minutes if one of the custom encryption values (initial fingerprint or encryption key) specified in the Server Admin is invalid.
Inventory reset parking zone The inventory of a parking zone has been reset to zero so that the reported parking zone occupancy can be re-initialized.
Last person out area The last cardholder has exited an area.
License plate hit Any hit rule A license plate read has been matched to a hotlist, an overtime rule, or a permit restriction.
License plate read ALPR unit or Genetec Patroller™ A license plate has been read.
Live bookmark added camera A user has added a bookmark to a live video.
Lock released zone Event related to a zone entity.
Lock secured zone Event related to a zone entity.
Loitering camera (video analytics) Loitering activity has been detected in the camera footage.
Low battery asset The battery on the RFID tag of an asset is about to run out.
Macro aborted macro Execution of a macro has failed.
Macro completed macro Execution of a macro has been completed normally.
Macro started macro Execution of a macro has begun.
Main database lost Directory Manager role Health event generated when the Directory database is lost.
Main database recovered Directory Manager role Health event generated when the Directory database has been recovered.
Manual station activated door Someone has pulled the door emergency release (manual pull station).
Manual station reverted to normal state door The door emergency release (manual pull station) has been restored to it normal operating position.
Maximum occupancy exceeded area Number of people in the area now exceeds the maximum occupancy limit.
Maximum occupancy reached area Number of people in the area has reached the maximum occupancy limit.
Memory usage high server Health event generated when the memory usage rises above the high threshold configured in the Health Monitor role's Properties page for this event.
Memory usage normal server Health event generated when the memory usage drops below the normal threshold configured in the Health Monitor role's Properties page for this event.
Missing tail host door The tail host of a two-host visitor delegation did not badge.
Motion camera There is motion detected.
Motion off camera This event is issued following a Motion on event when motion (measured in terms of number of motion blocks) has dropped below the “motion off threshold” for at least 5 seconds.
Motion on camera This event is issued when positive motion detection has been made.
Multiple units are configured for the interlock area All doors that are part of an interlock configuration must be controlled by the same unit.
Mustering ended area An evacuation has ended and people are no longer evacuating to the area. This event is generated from the Evacuation Assistant plugin only occurs for the last evacuation to the area.
Mustering started area An evacuation is in progress and people are evacuating to the area. This event is generated from the Evacuation Assistant plugin and only occurs for the first evacuation to the area.
No entry detected cardholder or door A cardholder was granted access to a door or area, but no entry is detected. For this event to be generated, you must configure a door sensor on the door side where you want entry to be detected.
No match ALPR unit, hotlist A vehicle has not been matched to the hotlist associated to the Sharp unit.
No RTP packet lost in the last minute camera The Archiver has received all the RTP packets in the last minute.
Object condition changed camera (video analytics) An object has suddenly changed direction or speed, such as when a person starts running or slips.
Object count changed camera (video analytics) A change has been detected in the object count on a camera equipped with video analytics capabilities.
Object count reached camera (video analytics) An object count limit has been reached for the object count on a camera equipped with video analytics capabilities.
Object crossed line camera (video analytics) An object has crossed a predefined tripwire.
Object detected camera (video analytics) An object is in the camera field of view.
Object detected in field camera (video analytics) An object has been detected in a zone that is being monitored for intrusion on a camera equipped with video analytics capabilities.
Object direction changed camera (video analytics) An object has been detected changing direction on a camera equipped with video analytics capabilities.
Object entered camera (video analytics) An object has entered the camera field of view.
Object exited camera (video analytics) An object has exited the camera field of view.
Object following route camera (video analytics) An object is following a predetermined route, in a specific direction.
Object left camera (video analytics) An object has entered and exited the camera field of view.
Object merged camera (video analytics) Two separate objects in the camera field of view have merged.
Object removed camera (video analytics) An object has been removed from the camera field of view.
Object separated camera (video analytics) An object within the camera field of view has separated into two objects.
Object stopped camera (video analytics) A moving object has stopped.
Object velocity changed camera (video analytics) An object has been detected changing speed on a camera equipped with video analytics capabilities.
Offload failed ALPR Manager, Genetec Patroller™ An offload from Genetec Patroller™ to Security Center has failed.
Offload successful ALPR Manager, Genetec Patroller™ An offload from Genetec Patroller™ to Security Center was successful.
Paid time started parking rule Parking time has been purchased through connected pay stations or mobile apps.
Parking zone capacity threshold reached parking zone The parking zone capacity has reached the capacity threshold that is defined in the ALPR Manager.
People count reset area The number of people counted in an area has been reset to 0.
Person added to area area A person has been added to an area.
Person falling camera (video analytics) A person falling has been detected in the camera.
Person removed from area area A person has been removed from an area.
Person running camera (video analytics) A person running has been detected in the camera.
Person sliding camera (video analytics) A person sliding has been detected in the camera.
Playback bookmark added camera A user has added a bookmark to a recorded video.
Protection threshold exceeded Archiver or Auxiliary Archiver role The Protected video threshold configured from the Archiver has been exceeded. You can monitor the percentage of disk space occupied by protected video files from the Statistics page in the Archiver's Resources tab in Config Tool.
PTZ activated camera (PTZ) A user started using the PTZ after it has been idle. The field indicates the user who activated the PTZ. This event is regenerated every time a different user takes control of the PTZ, even when the PTZ is still active.
PTZ locked camera (PTZ) A user has tried to move the PTZ while it is being locked by another user with a higher PTZ priority. The field indicates the machine, application type, and user who currently holds the lock.
PTZ stopped camera (PTZ) The PTZ has not been manipulated by any user after a predetermined period of time. The field indicates the user who last used the PTZ.
PTZ zoom started camera (PTZ) A user started zooming the PTZ. The Description field indicates the user who performed the zoom. Subsequent PTZ zoom by user events are generated if another user zooms the PTZ, or if the original user zooms the PTZ after the Idle delay has expired.
PTZ zoom stopped camera (PTZ) The PTZ has not been zoomed by any user after a predetermined period of time. The field indicates the user who last zoomed the PTZ.
Receiving RTP packets from multiple sources camera The Archiver is receiving more than one video stream for the same camera.
IMPORTANT: When this rare situation arises, the Archiver cannot tell which stream is the correct stream by looking at the source IP address because of the NAT (Network Address Translation), so an arbitrary choice is made. This can result in the wrong video stream being archived. However, the source IP address and port number of both streams are indicated in the field, and the two sources are labeled and . You can find the faulty unit that is causing this conflict.
Record updated (typically an area, but can be any type of entity) This event is raised by the Record Fusion Service when an event with contextual information linked to a record type is triggered in the system, such as when data is ingested through the Record Caching Service role.
Record cache ingestion failed Record Caching Service role An operation to import data into a record cache, triggered by one of the Ingest actions, has ended with an error. Partial data might have been saved. See Ingest event, Ingest file, and Ingest from web request in Action types.
Record cache ingestion finished Record Caching Service role An operation to import data into a record cache, triggered by one of the Ingest actions, has completed successfully.
Record cache ingestion started Record Caching Service role An operation to import data into a record cache, triggered by one of the Ingest actions, has started.
Recording problem camera There is a problem recording the camera. The problem might be due to an error writing to disk, an error writing to the Archiver database, or the fact that the camera is not streaming video when it should. If you see this error, contact your system Administrator to resolve the issue.
Recording started (alarm) camera The recording on a camera has been started as the result of an alarm being triggered.
Recording started (continuous) camera The recording on a camera has been started by a continuous archiving schedule.
Recording started (external) camera The recording on a camera has been started by the Start recording action. This action could have been triggered by another event or executed from a macro.
Recording started (motion) camera The recording on a camera has been started through motion detection.
Recording started (user) camera The recording on a camera has been started manually by a user.
Recording stopped (alarm) camera The recording on a camera has stopped because the alarm recording time has elapsed.
Recording stopped (continuous) camera The recording on a camera has stopped because it is no longer covered by a continuous archiving schedule.
Recording stopped (external) camera The recording on a camera has been stopped by the Stop recording action. This action could have been triggered by another event or executed from a macro.
Recording stopped (motion) camera The recording on a camera has stopped because the motion has ceased.
Recording stopped (user) camera The recording on a camera has been stopped manually by a user.
Remaining archive disk space low Archiver or Auxiliary Archiver role Health event generated when the archiving disk space usage rises above the threshold configured in the Health Monitor role's Properties page for this event.
Remaining archive disk space normal Archiver or Auxiliary Archiver role Health event generated when the archiving disk space usage drops below the threshold configured in the Health Monitor role's Properties page for this event.
Request to exit door Someone has pressed the door release button or has triggered a request to exit motion detector. The Request to exit event has special filtering to make this feature compatible with motion detection request to exit hardware. Set these properties in the Config Tool > Door > Properties tab.
Request to exit normal door No request to exit is being made.
Retrieving archives from units failed Archiver role or officer Health event generated when the retrieval of video archives from wearable cameras has failed.
Retrieving archives from units partially failed Archiver role or officer Health event generated when the retrieval of video archives from some of the wearable cameras has failed.
Retrieving archives from units succeeded Archiver role or officer Health event generated when the retrieval of video archives from wearable cameras has succeeded.
Role started any role Health event generated when a role starts.
Role stopped by user any role Health event generated when a role is stopped by a user.
Role stopped unexpectedly any role Health event generated when a role is stopped unexpectedly. For example, the role crashed.
RTP packet loss high Officer or Security Desk Health event generated when the ratio of lost RTP packets rises above the threshold configured in the Health Monitor role's Properties page for this event.
RTP packet loss normal Officer or Security Desk Health event generated when the ratio of lost RTP packets drops below the threshold configured in the Health Monitor role's Properties page for this event.
RTP packets lost camera There are RTP packets that the Archiver never received. This could happen if the packets have been lost on the network, or if the Archiver does not have enough CPU to process all the packets received on the network card. The field indicates the number of packets lost since the last time this event was issued (no more than once every minute).
Scheduled controlled access elevator The schedule for controlled access to elevator floors now applies.
Scheduled free access elevator The schedule for free access to elevator floors now applies.
Scheduled lock door The door unlock schedule has expired, the lock is now re-asserted (door is locked).
Scheduled unlock door The door lock is unlocked due to a programmed unlock schedule.
Schedule unlock ignored: first-person-in rule supervisor absent door The door unlock schedule is ignored because the restriction imposed by the first-person-in rule has not yet been satisfied.
Server started server Health event generated when a Genetec™ Server service starts.
Server stopped by user server Health event generated when a Genetec™ Server service is stopped by a user.
Server stopped unexpectedly server Health event generated when a Genetec™ Server service is stopped unexpectedly.
Session completed parking zone The vehicle has exited the parking zone.
Session started parking zone The vehicle has entered the parking zone.
Signal lost camera The camera signal has been lost.
Signal recovered camera The camera signal has been recovered.
Signed token creation is ready Directory role Health event generated when the system successfully created a token for authentication.
Supervisor in: access rule activated door First-person-in rule is enforced on an area, and a supervisor has just badged in, allowing all cardholders with the correct access rights to enter the area.
Supervisor in: unlocking schedule activated door First-person-in rule is enforced on an area, and a supervisor has just badged in, allowing anyone to enter the area.
Synchronization completed: External system Active Directory role The synchronization of an external system has completed.
Synchronization error: External system Active Directory role The synchronization of an external system has resulted in an error.
Synchronization failed Active Directory role Health event generated when the synchronization of an Active Directory has failed.
Synchronization partially completed due to some conflicts: External system Active Directory role The synchronization of an external system was only partially completed.
Synchronization recovered Active Directory role Health event generated when the synchronization of an Active Directory has recovered.
Synchronization started: External system Active Directory role The synchronization of an external system has started.
Tailgating camera (video analytics) Two people have entered a secured area following each other very closely.
Temperature alarm video unit The temperature of the video unit has risen above the safety level.
Threat level cleared threat level A threat level has been cleared.
Threat level set threat level A threat level has been set.
Transmission lost camera The Archiver is still connected to the camera, but it has not received any video packets for more than 5 seconds.
Transmission recovered camera The Archiver has started to receive video packets from the camera again.
Undefined video analytics event camera (video analytics) A generic video analytic event has been issued, but it is not yet mapped to a Security Center event.
Tip: You can check for additional sub-type information in the analytic metadata.
Unit connected unit The connection to a unit has been established or restored.
Unit failed to respond to edge video request camera Event related to a camera that is recording directly on the unit.
Unit lost unit The connection to a unit has been lost.
Unit synchronization failed access control unit The synchronization of the unit with the Access Manager has failed.
Unit synchronization started access control unit The synchronization of the unit with the Access Manager has started.
Unit synchronization succeeded access control unit The synchronization of the unit with the Access Manager has completed successfully.
Unit time in sync with time server video unit Health event generated when the unit time is in sync with the time server.
Unit time out of sync with time server video unit Health event generated when the unit time is out of sync with the time server.
Unit warning activated access control unit The Synergis™ Cloud Link unit has gone into a warning state. The reason for the warning is detailed in the event description.
Unit warning deactivated access control unit The Synergis™ Cloud Link unit is no longer in a warning state. The latest reason for the warning is detailed in the event description.
Update failed Genetec Patroller™, Mobile Sharp An update on Genetec Patroller™ or a Mobile Sharp unit has failed, or a file could not be synchronized on a Genetec Patroller™ computer.
Update installation completed Genetec Patroller™, Mobile Sharp An update has completed on Genetec Patroller™ or a Mobile Sharp unit, and no reboot is required.
Update installation started Genetec Patroller™, Mobile Sharp A user has started an updated on Genetec Patroller™ by clicking the “Update” icon.
Update published Genetec Patroller™, Mobile Sharp An update has been processed, and is ready to be deployed to Genetec Patroller™.
Update uninstallation completed Genetec Patroller™, Mobile Sharp A rollback on Genetec Patroller™ or a Mobile Sharp unit has completed.
Update uninstallation started Genetec Patroller™, Mobile Sharp A user has started a rollback on Genetec Patroller™ by clicking the “Rollback” icon.
User logged off user A user has logged off of a Security Center application.
User logged on user A user has logged on to a Security Center application.
User logon failed user User logon attempt failed.
Validating paid time parking rule The convenience time or the paid time has expired for the parking session.
Video signal lost camera Health event generated when the camera signal has been lost.
Video signal recovered camera Health event generated when the camera signal has been recovered.
Violation detected parking rule The convenience time, the grace period, or the paid time has expired for the parking session.
Violation enforced parking rule The vehicle in violation has been ticketed.
Visitor astray door A visitor did not badge within the allotted time after the delegation's host or a previous visitor.
VRM connection attempt Archiver role The Archiver has attempted to connect to a VRM unit.
VRM connection failure Archiver role The Archiver has failed to connect to a VRM unit.
Window closed zone A physical window has closed.
Window opened zone A physical window has opened.
Zone armed zone A zone has been armed.
Zone disarmed zone A zone has been disarmed.
Zone maintenance completed I/O zone An I/O zone has been taken out of maintenance mode.
Zone maintenance started I/O zone An I/O zone has been put into maintenance mode.
Zone offline I/O zone An I/O zone is offline.

For a list of events that can be used with KiwiVision™ video analytics, see Events to monitor in Security Desk.