# Event Logging

When you use Intel Packet Protect for secure communications, it produces certain log messages that are placed in a log. These messages report various events that occur when you use Intel Packet Protect. These messages can be informational or can report errors and warnings.

Logging these events is optional. You can choose whether you want to log events all the time or if you only want to log events for special reasons. The information in the log can be very helpful in diagnosing and fixing problems with Intel Packet Protect. If you are experiencing problems communicating securely with Intel Packet Protect, you may want to enable logging to help solve the problem.

How do I enable event logging?

## About Log Entries

Some events are logged when you use Intel Packet Protect. Events on Windows NT*-based systems are also logged in the NT Event Log, along with all other Windows NT events. Events on Windows 98- or Windows ME-based systems are logged in the Intel Packet Protect Log.

How do I view the Intel Packet Protect Log?

How do I view log entries in Windows NT Event Log?

### Types of Log Entries

Use this table to understand the three different types of log entries. Intel Packet Protect log entries will be one of these types.

- Information - Information events describe the successful operation of a Intel Packet Protect event. For example, if you stop the Intel Policy Agent, this event will be reported as Information. These messages do not usually mean that there is a problem with Intel Packet Protect.

- Warning - Warning events are not usually significant, but should be monitored. For example, warnings may be sent when your system is running low on memory and Intel Packet Protect cannot successfully perform an action. In many cases, you will be able to continue using Intel Packet Protect when you receive warning messages.

- Error - Error events indicate a significant problem, such that Intel Packet Protect can no longer run properly. These errors are usually given when the product is not installed correctly or when files that Intel Packet Protect uses have been corrupted. You might have to restart Intel Packet Protect or perhaps reboot your system in order to use Intel Packet Protect successfully. Error message logs should be retained, as they can be used by your system administrator or Intel Customer Support for solving problems.

### Format of Log Entries

The log entries are listed in order of occurrence, like this:

    {93} 2001/01/15 19:25:36.328 <0/7/1610620928> [logger]Intel Logger started
    {169} 2001/01/15 19:25:57.067 <1/7/1610616832> [PAgent]Intel Policy Agent Service started

Log entries have the following format:

    {ThreadID} YYYY/MM/DD hh:mm:ss.msec <Type /Severity/Message ID> [Component] Error Message

Thread ID | This is the system-assigned serial number for the thread that generated this message.
Type | This is always set to 1 (Information 1, status 2, warning 3, error 4)
Severity | This identifies the severity of the message. This is normally set to "6" or "7".
Message ID | This is the Message ID assigned by Intel Packet Protect. It is used for debugging.
Component | This is the software identity that reported the message.

## Intel Packet Protect Log Entries

### Information logs

If you receive any informational event, you do not need to take any action as long as the machines are still communicating under policy.

Text of Event | Explanation | Resolution
Policy Agent Service Stopped. | PolicyAgent was stopped. The system will not perform IPSec operations and will communicate to peers in the clear (if the peers are configured compatibly). | No action needed.
Intel Policy Agent Service Started | PolicyAgent was started successfully. The system is ready to communicate with peers using IPSec (if the peers are configured compatibly). | No action needed.
Exception file pagent.exe, being created – Unhandled Exception | There was an exception in the Policy Agent process. | No action needed.
IPSec Object Failed Instantiation <failure code> | Could not instantiate IPSec. Reasons for this error could be: IPSec.dll is not registered. IPSec is NOT enabled on any of the adapters in the machine. The TCP/IP stack is not setup correctly. | Check if ipsec.dll is registered Check if IPSec is enabled using PROSet II. Check if adapter/protocol bindings are correct using Network Properties.
Intel Policy Agent Failed to Start. | Policy Agent initialization failed. | This is usually a secondary message. IKE or IPSec failed to instantiate.
IKE Object Failed Instantiation <failure code> | Could not instantiate IKE. Reasons for this error could be: In Windows 98, DCOM98 is not installed correctly. CDSA is not installed correctly. IKE.dll is not registered. | Re-register IKE. To do this, use Windows Explorer and browse to Program Files\Packet Protect\bin. Right-click on ike.dll and select Open. If the error message persists, re-install DCOM98 at http://www.microsoft.com/com/dcom/ dcom98/download.asp. If the error message persists, check that the CDSA files are intact. If all else fails, re-install Intel Packet Protect.
Another reason why IKE failed instantiation could be due to the Intel Packet Protect process restarting too quickly after a policy change. The system will automatically recover from this situation, and communication will restart with the new policy. | No action needed.
IKE Failure: Self <SourceAddress>, Peer <DestinationAddress>, IKE Event <40001> IKE Phase I Timeout IKE Failure: Self <SourceAddress>, Peer <DestinationAddress>, IKE Event <40002> IKE Phase II Timeout. | Your machine did not get a timely response from a peer on an IKE message. The IKE negotiation will automatically be re-tried. | If the renegotiation does not succeed, check to see if there is a problem with the peer system or the network itself.
Frequent occurrences of IKE failure messages in the log may occur if you are talking to a peer machine in the clear, as specified in the policy. This is not an erroneous condition. | No action needed.

Copyright © 2002 Intel Corporation. Legal Information