Hub Audit Event Types

Every Hub audit event has one of the types below, stored in the event_type column of hub_audit_entry and named in each hub-audit.log line. The Event list on the Audit Log page offers every type. See Hub Audit Log for where events are written and the shape of an entry.

Sign-In, Proxy, Tunnel and Audit Log Events

Event Type	Written when
HUB_LOGIN_SUCCESS	A user signs in to the Hub
HUB_LOGIN_FAILURE	A sign-in to the Hub fails; the details give the reason
SITE_PROXY_OPENED	A user opens a site through the proxy, once per Hub session and site
SITE_PROXY_CLOSED	The Hub session that opened a site ends (sign-out, idle timeout or shutdown)
SITE_LOGIN_ATTEMPT_THROTTLED	The login throttle refused a proxied site login on the edge from throttling to refusing
TUNNEL_CONNECTED	A site established a tunnel
TUNNEL_DISCONNECTED	A tunnel closed (heartbeat loss, idle timeout or an explicit close)
TUNNEL_TAKEOVER_DETECTED	A site connected while it already had an open tunnel; the new connection wins and the old one is closed. Repeated takeovers are a security signal (see Tunnel Takeover Detection)
AUDIT_LOG_EXPORTED	An administrator exported the audit log. The details carry the filters used, the number of rows written, and whether the file was completed (see Exporting the Audit Log)

Enrollment and Site Events

Event Type	Written when
BUNDLE_GENERATED	An operator generated a .qcb bundle file
BUNDLE_REISSUED	An operator generated a recovery (re-enrollment) bundle for an existing site
BUNDLE_CONSUMED	A bundle was redeemed at /register, for a first enrollment or a re-enrollment
BUNDLE_REUSE_REJECTED	A /register call was refused because of the bundle's own state. The reason detail is already-consumed, lost-commit-race (consumed by a rival registration during this one) or unknown (no such bundle)
BUNDLE_EXPIRED_REJECTED	A /register call with an expired bundle was refused
BUNDLE_REVOKED	An operator canceled an issued bundle before it was redeemed
BUNDLE_REVOKED_REJECTED	A /register call with a canceled bundle was refused
SITE_REGISTERED	A site was created, together with BUNDLE_CONSUMED, at its first enrollment
SITE_REKEYED	An existing site's certificate was replaced by re-enrollment, together with BUNDLE_CONSUMED; its identity and history are kept
SITE_REGISTRATION_REJECTED	A site's registration was refused. The reason detail is license-site-limit or failed-check-in-lockdown for a licensing refusal, subdomain-already-registered, registration-already-in-progress, site-changed-during-reenrollment, reenroll-site-not-found or bundle-not-found. The bundle stays redeemable once the cause clears, except for bundle-not-found, where a new bundle is needed
SITE_DELETED	An operator deleted a site
SITE_DISABLED	An operator disabled a site
SITE_ENABLED	An operator re-enabled a disabled site
SITE_UPDATED	A Hub administrator changed a site's Display Name, description or color in Site Details. The changed detail lists the fields that changed, the displayName and color details carry the values saved, and the label detail names the site's subdomain label. A change to the site's tags is written as SITE_TAG_ADDED or SITE_TAG_REMOVED instead
CERT_REVOKED	A certificate was revoked (operator action, rotation, suspected compromise or decommission)

The client certificate and CA rotation events (CLIENT_CERT_CYCLE_*, CA_ROTATION_*, CA_TRUST_ADDED and CA_TRUST_REMOVED) are described in SSL and PKI.

Grant and Tag Events

Event Type	Written when
GRANT_ADDED	A role was given one grant for one tag, on the Manage Roles page. The details give the role's roleId and roleName, the grant (CONSOLE, JOBS or MCP), and the tag's tagUuid and tagName. There is no target site
GRANT_REMOVED	A role's grant for one tag was taken away, with the same details as GRANT_ADDED. When the grant went because its tag or its role was deleted, a reason detail says tag deleted or role deleted, and the role's name is not given
ACL_GRANTED	No longer written, since access comes from role grants on tags. An entry that names it records a user or role given access to one site, on a Hub that granted access per site
ACL_REVOKED	No longer written, for the same reason. An entry that names it records a user's or role's access to one site taken away
TAG_CREATED	A tag was added; the details name its tagUuid and tagName
TAG_UPDATED	A tag was renamed or its description changed
TAG_DELETED	A tag was deleted, after a GRANT_REMOVED for each role grant that named it
SITE_TAG_ADDED	A site was given a tag, from the Tags page, from Site Details or at enrollment; the target site is the site
SITE_TAG_REMOVED	A tag was taken off a site

Statement Events

Event Type	Written when
STATEMENT_SIGNING_KEY_ISSUED	The Hub issued a new statement-signing key and certificate: the first one, a renewal, or one under a new internal CA. The details give the certificate's serial and expiry time. No user is named
STATEMENT_SIGNED	The Hub signed a statement for a site. Written to hub-audit.log only, never to the table (see Statements in the Log)

Job Events

Every job event names the job and its id. An event a person caused names that person; an event the Hub caused on its own names no user. See Jobs for what each action means.

Event Type	Written when
JOB_CREATED	A draft was created, copied from another job (copiedFrom), or made as a rerun of a job's not-run sites (rerunOf, with the number of sites)
JOB_UPDATED	A draft was changed
JOB_DELETED	A draft was deleted
JOB_SUBMITTED	A draft was submitted; the details give the number of sites and whether it needs approval
JOB_APPROVED	A job was approved
JOB_REJECTED	A job was rejected; the details give the reason
JOB_WITHDRAWN	The preparer withdrew a job before it started
JOB_STARTED	A job was started
JOB_PAUSED	A person paused a job, or the Hub paused it with a reason: a CA rotation or a Hub lockdown (see Hub Lockdowns)
JOB_RESUMED	A person resumed a job, or the Hub lifted its own pause
JOB_CONTINUED	A person continued a job past a checkpoint; the details give the step
JOB_STOPPED	A person stopped a job, or the Hub stopped it with a reason: the failure limit was reached (a halt), or the preparer or approver was disabled or deleted. When the job was already stopping or halting, the entry names the disabled person and the job keeps its own reason
JOB_ENDED	Every site of a job has ended; the details count the sites by outcome
JOB_ROLLBACK_REQUESTED	A person asked for a site of a job to be rolled back; the details name the site
JOB_FILE_PURGED	No longer written, since a job keeps its configuration file until its record is deleted. An entry that names it records the Hub deleting a job's configuration file at the end of a retention window
JOB_SETTINGS_RESTORED	A configuration import changed the Approval Threshold (sites) or the Statement Retention (days). The user is the person who ran the import, and the details give both values before and after (see Hub Disaster Recovery)