View and Export Events

You can view events by default in the PCE web console or the PCE command line. You can then export Organization events using the PCE web console.

View Events in PCE Web Console

By default, the PCE web console shows events in your organization, such as when a workload is paired, if a pairing failed, when a user logs in or logs out, when a user fails to authenticate, and so on.

If you want to see only certain events, you can filter by event type to see those that interest you most. You can also search for Organization events by their universally unique identifier (UUID) and filter events by their severity.

You can also export the list of organization events as a CSV file.

To view Organization events:

From the PCE web console menu, choose Troubleshooting > Events.

You can filter events by several criteria, such as severity, status, timestamp, or who generated them.

Note

The suggested values for the filters are generated from all possible values. For example, the “Generated By” filter shows all users on the system. However, the actual results displayed by that filter might not contain any data.

VEN Event Not Displayed in PCE Web Console

The following events related to VENs are not currently viewable in the PCE web console.

This is a two-column list of event names.

VEN Events not shown in PCE Web Console
`fw_tampering_revert_failure`	`lost_agent`
`fw_tampering_reverted`	`missing_os_updates`
`fw_tampering_subsystem_failure`	`pce_incompat_api_version`
`invoke_powershell_failure`	`pce_incompat_version`
`ipsec_conn_state_change`	`pce_reachable`
`ipsec_conn_state_failure`	`pce_unreachable`
`ipsec_monitoring_failure`	`proc_config_failure`
`ipsec_monitoring_started`	`proc_envsetup_failure`
`ipsec_monitoring_stopped`	`proc_init_failure`
`ipsec_subsystem_failure`	`proc_malloc_failure`
`ipsec_subsystem_started`	`proc_restart_failure`
`ipsec_subsystem_stopped`	`proc_started`
`refresh_token_failure`	`proc_stopped`
`refresh_token_success`

View Events Using PCE Command Line

Run this command at any runlevel to display:

The total number of events
The average number of events per day

sudo -u ilo-pce illumio-pce-db-management events-db events-db-show

Run this command at any runlevel to display:

The amount of disk space used by events
The total number of events

sudo -u ilo-pce illumio-pce-db-management events-db disk-usage-show

Export Events Using the PCE Web Console

You can export all Organization events or export a filtered list of organization events to a CSV file.

From the PCE web console menu, choose Troubleshooting > Events.
You see a list of events based on the activities performed.
Click Export > Export All to export all Organization events.
To export a filtered list of events, filter the list and then click Export > Export Filtered to export only the filtered view.
Use the search filter for events based on event type, severity, status, timestamp, and who generated them.

Illumio Core 25.2.10 Administration Guide