View and Export Events

By default, you can view events in the PCE web console or by using the PCE command line. You can then export Organization events using the PCE web console.

View Events in PCE Web Console

By default, the PCE web console shows events that occur in your organization, such as when a workload is paired, if a pairing failed, when a user logs in or logs out, when a user fails to authenticate, and so on.

If you want to see only certain events, you can filter by event type to see events that interest you most. You can also search for Organization events by their universally unique identifier (UUID), and filter events by their severity.

You can also export the list of organization events as a CSV file.

To view Organization events:

From the PCE web console menu, choose Troubleshooting > Events.

At the top of the page, you can use the Event Filter to filter the list by event type.

NOTE:

In the Events Viewer, the suggested values for the filters are generated from all possible values. For example, the “Generated By” filter shows all users on the system. However, the actual results displayed by that filter might not contain any data.

VEN Event Not Displayed in PCE Web Console

The following events related to VENs are not currently viewable in the PCE web console.

This is a two-column list of event names.

VEN Events not shown in PCE Web Console
`fw_tampering_revert_failure`	`lost_agent`
`fw_tampering_reverted`	`missing_os_updates`
`fw_tampering_subsystem_failure`	`pce_incompat_api_version`
`invoke_powershell_failure`	`pce_incompat_version`
`ipsec_conn_state_change`	`pce_reachable`
`ipsec_conn_state_failure`	`pce_unreachable`
`ipsec_monitoring_failure`	`proc_config_failure`
`ipsec_monitoring_started`	`proc_envsetup_failure`
`ipsec_monitoring_stopped`	`proc_init_failure`
`ipsec_subsystem_failure`	`proc_malloc_failure`
`ipsec_subsystem_started`	`proc_restart_failure`
`ipsec_subsystem_stopped`	`proc_started`
`refresh_token_failure`	`proc_stopped`
`refresh_token_success`

View Events Using PCE Command Line

Run this command at any runlevel to display:

The total number of events
The average number of events per day

$ sudo -u ilo-pce illumio-pce-db-management events-db events-db-show

Run this command at any runlevel to display:

The amount of disk space used by events
The total number of events

$ sudo -u ilo-pce illumio-pce-db-management events-db disk-usage-show

Export Events Using PCE Web Console

You can export all Organization events, or export a filtered list organization events to a CSV file.

To export events:

From the PCE web console menu, choose Troubleshooting > Events.

You see a list of events based on the activities performed.
Click Export > Export All to export all Organization events.
To export a filtered list of events, filter the list and then click Export > Export Filtered to export only the filtered view.
To search for events based on event type, severity, status, timestamp, and who generated them, use the search filter:
For a faster filtering via the browser, use the following field: