Event types

All events in Security Center are associated with a source entity, which is the main focus of the event.

Security Center supports the following event types:

Event	Source entity	Description
Ability to write on a drive has been restored	Archiver or Auxiliary Archiver role	Ability to write on a drive has been restored.
Access denied: Antipassback violation	door	A cardholder requested access to an area that they have already entered, or requested access to leave an area that they were never in.
Access denied: A second cardholder is required	door	Two cardholders must present their credentials within a certain delay of each other and the delay has expired. This event only applies to doors controlled by Synergis™ units.
Access denied: Denied by access rule	door or elevator	The cardholder is denied access according to the access rule.
Access denied: Max occupancy reached	door	The cardholder is denied because the area is at its occupancy limit.
Access denied: Escort not supported by this unit model	door	The visitor escort rule is enforced on an area, but the unit controlling its doors does not support this feature.
Access denied: Expired credential	cardholder, credential, door, or elevator	An expired credential has been used.
Access denied: First-person-in rule supervisor absent	door	The first-person-in rule has been enforced on the area, and no supervisor has arrived yet.
Access denied: Inactive cardholder	cardholder, door, or elevator	A cardholder with an inactive profile has attempted to access a door or elevator.
Access denied: Inactive credential	cardholder, credential, door, or elevator	A credential with an inactive profile has been used.
Access denied: Insufficient privileges	door or elevator	The cardholder is denied access because they do not have the required security clearance. This event only applies to doors controlled by Synergis™ units.
Access denied: Interlock	door	Access is denied because of an interlock constraint.
Access denied: Invalid PIN	door or elevator	The cardholder entered an invalid PIN.
Access denied: Lost credential	cardholder, credential, door, or elevator	A credential that has been declared as lost has been used.
Access denied: No access rule assigned	door or elevator	The cardholder is denied access because they are not assigned any access rights.
Access denied: Out of schedule	door or elevator	The access rule associated with this cardholder does not apply during the date or time specified in the schedule.
Access denied: Stolen credential	cardholder, credential, door, or elevator	A credential that has been declared as stolen has been used.
Access denied: Unassigned credential	credential, door, or elevator	A credential that has not been assigned to a cardholder has been used.
Access denied: Unknown credential	door or elevator	A credential that is unknown in the Security Center system has been used.
Access denied: Valid card, invalid PIN	door or elevator	A card and PIN are required to enter an area, and the cardholder entered an invalid PIN.
Access denied: Visitor's companion was denied	door	In a visitor escort scenario, one of the visitors or their host has been denied access.
Access granted	cardholder, door, or elevator	Access has been granted through a door to a cardholder according to the access rules governing the door, elevator, or area. For a perimeter door of an interlock: When an authorized cardholder accesses a door of an interlock, Security Center might generate an Access granted event for the door even though the door does not unlock (due to another perimeter door already being open).
AC fail	access control unit or intrusion detection unit	AC (alternating current) has failed.
A door of an interlock has an unlock schedule configured	area	A door that is part of an interlock configuration has an unlock schedule configured.
A door of an interlock is in maintenance mode	area	A door that is part of an interlock configuration is in maintenance mode.
Adaptive motion triggered	camera (video analytics)	Motion has been detected on a camera equipped with video analytics capabilities.
Alarm acknowledged	alarm	An alarm has been acknowledged by a user, or auto-acknowledged by the system.
Alarm acknowledged (alternate)	alarm	An alarm has been acknowledged by a user using the alternate mode.
Alarm being investigated	alarm	An alarm with a acknowledgment condition that is still active has been put into the under investigation state.
Alarm condition cleared	alarm	The acknowledgment condition of an alarm has been cleared.
Alarm forcibly acknowledged	alarm	An alarm has been forcibly acknowledged by a user with special privileges.
Alarm triggered	alarm	An alarm has been triggered.
An interlock cannot be in hard antipassback mode	area	An interlock cannot be in hard antipassback mode. This is an illegal configuration.
An interlock cannot have a perimeter door with no door sensor configured	area	Interlock cannot be enforced if the system cannot tell whether a door is open or not.
An interlock cannot have only one perimeter door	area	You need at least two perimeter doors for interlock to be applied.
Antipassback disabled: Invalid settings	area	Antipassback disabled: Invalid settings.
Antipassback disabled: Not supported when unit is in server mode	area	Units have not been set to server mode. Antipassback is available according to the unit’s operating mode. For more information about unit limitations, see the Security Center Release Notes.
Antipassback disabled: Unit is offline	area	At least one unit is in offline mode, disabling antipassback. Antipassback is available according to the unit’s operating mode. Refer to the Security Center Release Notes for more information about unit limitations.
Antipassback violation	area or cardholder	An access request was made to enter an area with a credential that is already inside the area, or to exit an area with a credential that was never in the area.
Antipassback violation forgiven	cardholder	A security operator has granted access to a cardholder responsible for a passback violation.
Application connected	application or role	An application or a role has connected to the Directory.
Application lost	application or role	An application or a role has lost its connection to the Directory.
Archive folder path is too long	Archiver or Auxiliary Archiver role	The disk base path for video archives has exceeded the maximum length permitted by the operating system.
Archiving disk changed	Archiver or Auxiliary Archiver role	The Allotted space on one of the disks assigned for archive storage for this Archiver has been used up, and the Archiver has switched to the next disk in line. The names of the previous disk and current disk are indicated in the Description field.
Archiving queue full	camera	A camera (video encoder) is streaming video faster than the Archiver is able to write the video packets to disk. A problem with the Archiver database also triggers this event. The name of the camera whose packets are lost is indicated in the Description field.
Archiving stopped	Archiver or Auxiliary Archiver role	Archiving has stopped because the disks allocated for archiving are full. This event always accompanies a Disk full event.
Asset moved	asset	An asset has been moved.
Asset offline	asset	The RFID tag of an asset has gone offline.
Asset online	asset	The RFID tag of an asset has gone online.
Audio alarm	camera	A sound has been picked up by a microphone associated with a camera.
Audio analytics event	camera (video analytics)	An audio analytics event has been detected on a camera equipped with audio analytics capabilities.
Badge printing job cancelled	user	A user has canceled a badge printing job.
Badge printing job completed	user	A user has completed a badge printing job.
Badge printing job queued	user	A user has queued a badge printing job.
Battery fail	access control unit or intrusion detection unit	The unit battery has failed.
Block camera started	camera	A user has blocked a video stream from other users in the system.
Block camera stopped	camera	A user has unblocked a video stream from other users in the system.
Camera not archiving	camera	The camera is on an active archiving schedule but the Archiver is not receiving the video stream.
Camera tampering	camera (video analytics)	A dysfunction has occurred, potentially due to camera tampering, resulting in a partial or complete obstruction of the camera view, a sudden change of the field of view, or a loss of focus.
Cannot write on the specified location	Archiver or Auxiliary Archiver role	The Archiver cannot write to a specific drive. The path to the drive is indicated in the Description field.
Cannot write to any drive	Archiver or Auxiliary Archiver role	The Archiver is unable to write to any of the disk drives. This situation can arise for the following reasons: When write accesses to shared drives are revoked. When shared drives are inaccessible. When shared drives no longer exist. When this happens, archiving is stopped. The Archiver re-evaluates the drive status every 30 seconds.
Capacity threshold reached	parking zone	The parking zone capacity has reached the capacity threshold that is defined in the LPR Manager.
Convenience time started	parking rule	The convenience time portion of the parking session has begun.
Credential has expired	credential	A credential has expired.
Crowd detected	camera (video analytics)	A crowd or queue has been detected on a camera equipped with video analytics capabilities.
Custom event	system-wide	A custom event is an event added after the initial system installation. Events defined at system installation are called system events. Custom events can be user-defined or automatically added through plugin installations. Unlike system events, custom events can be renamed and deleted.
Database lost	Archiver or Auxiliary Archiver role	The connection to the role database was lost. If this event is related to a role database, it might be because the database server is down or cannot be reached by the role server. If the event is related to the Directory database, the only action you can use is Send an email because all other actions require a working connection the Directory database.
Database recovered	Archiver or Auxiliary Archiver role	The connection to the role database has been recovered.
Deadbolt locked	zone	The deadbolt on a door has been locked.
Deadbolt unlocked	zone	The deadbolt on a door has been unlocked.
Direction alarm	camera (video analytics)	A direction alarm has been triggered on a camera equipped with video analytics capabilities.
Disk load threshold exceeded	Archiver or Auxiliary Archiver role	The disk space allocated for archiving has exceeded its load threshold (default=90%). This is caused by under-evaluating the disk space required, or by another application that is taking more disk space than it should. If 100% of the allotted disk space is used, the Archiver starts to delete old archive files prematurely to free disk space for new archive files, starting with the oldest files.
Disks full	Archiver or Auxiliary Archiver role	All disks allotted for archiving are full and the Archiver is unable to free disk space by deleting existing video files. This event can occur when another application has used up all the disk space reserved for Security Center, or when the Delete oldest files when disks full option is not selected in the Server Admin. When this happens, archiving is stopped. The Archiver re-evaluates the disk space every 30 seconds.
Door closed	door	The door has closed. For this event to be generated, the door must be equipped with a door sensor.
Door forced open	door	The door is locked but the door sensor indicates that the door is open.
Doorknob in place	zone	The doorknob is in place and the door is closed.
Doorknob rotated	zone	The doorknob has rotated.
Door locked	door	The door has locked.
Door maintenance completed	door	The door has been taken out of maintenance mode.
Door maintenance started	door	The door has been put into maintenance mode.
Door manually unlocked	door	In Security Desk, a user has manually unlocked a door.
Door offline: Device is offline	door	One or more devices associated to this door has gone offline.
Door opened	door	The door has opened. For this event to be generated, the door must be equipped with a door sensor.
Door open too long	door	The door has been held open for too long. To enable this event, you must set the property “Trigger a ‘Door open too long’ event” in the Properties tab of a Door entity in Config Tool.
Door unlocked	door	The door has been unlocked.
Double-badge off	cardholder, credential, or door	The door has been locked and an associated event has stopped.
Double-badge on	cardholder, credential, or door	The door has been unlocked and an associated event has been triggered.
Edge storage medium failure	camera	After a unit was restarted, the video that was recorded on the edge could not be accessed.
Elevator offline: Device is offline	elevator	One or more devices associated to this elevator has gone offline.
End of camera tampering	camera (video analytics)	A dysfunction, which might have been caused by camera tampering, has been resolved.
Entity has expired	credential	A credential or its associated cardholder has expired (its status is now Expired).
Entity is expiring soon	cardholder or credential	Security Center generates this event to warn you that the expiry date of an entity is approaching. The number of days of advance warning provided by this event must be set.
Entity warning	any entity	A health warning has been issued for this entity.
Entry assumed	cardholder or door	A cardholder was granted access to a door or area, and it is assumed that they entered because no door sensor is configured.
Entry detected	cardholder or door	A cardholder was granted access to a door or area, and their entry is detected. For this event to be generated, you must configure an entry sensor on the door side where you want entry to be detected. If no Entry Sensors are configured on the door, the event will be generated based on the Door Sensor input.
Face detected	camera (video analytics)	A face has been detected on a camera equipped with video analytics capabilities.
Face recognized	camera (video analytics)	A face on a hotlist has been recognized by a camera equipped with video analytics capabilities.
File deleted	camera	A video file associated to a camera has been deleted because the retention period has ended, or the archive storage disk was full.
Firmware upgrade failed	access control unit	A firmware upgrade on an access control unit has failed.
Firmware upgrade started	access control unit	A firmware upgrade on an access control unit has been started.
Firmware upgrade succeeded	access control unit	A firmware upgrade on an access control unit has completed successfully.
First person in	area	A cardholder has entered an empty area.
Floor accessed	elevator	An elevator floor button has been pressed.
Glass break	zone	Glass has broken.
Hardware tamper	access control unit, door, elevator, or zone	The tamper input on a unit has been triggered.
Health event	Health monitor role	A health event has occurred.
Heat map changed	camera (video analytics)	A change has been detected in a heat map area on a camera equipped with video analytics capabilities.
Input alarm activated	input on intrusion detection unit	The input has entered an alarm state.
Input alarm restored	input on intrusion detection unit	The input has left an alarm state.
Input bypassed	input on intrusion detection unit	The input has entered a bypassed state.
Input bypass restored	input on intrusion detection unit	The input has left a bypassed state.
Input state changed: Input active	input on camera, access control unit, or intrusion detection unit	The input has entered an active state.
Input state changed: Input normal	input on camera, access control unit, or intrusion detection unit	The input has entered a normal state.
Input state changed: Input trouble	input on access control unit or intrusion detection unit	The input has entered a trouble state.
Interlock is not supported by the unit	area	Interlock is enabled on an area but the access control unit controlling the doors does not support this feature.
Interlock lockdown input active	area	Interlock lockdown has been turned on.
Interlock lockdown input normal	area	Interlock lockdown has been turned off.
Interlock override input active	area	Interlock override is on.
Interlock override input normal	area	Interlock override is off.
Intrusion detection area alarm activated	intrusion detection area	Intrusion detection area alarm activated.
Intrusion detection area arming	intrusion detection area	Intrusion detection area is being armed.
Intrusion detection area arming postponed	intrusion detection area	Intrusion detection area arming is postponed.
Intrusion detection area cancelled alarm	intrusion detection area	Intrusion detection area alarm is cancelled.
Intrusion detection area cancelled postponed request	intrusion detection area	Intrusion detection area postponed request is cancelled.
Intrusion detection area disarmed	intrusion detection area	Intrusion detection area is disarmed.
Intrusion detection area disarm request	intrusion detection area	Intrusion detection area postponed request is cancelled.
Intrusion detection area duress	intrusion detection area	Intrusion detection area is disarmed with duress.
Intrusion detection area entry delay activated	intrusion detection area	Intrusion detection area entry delay activated.
Intrusion detection area forced arming	intrusion detection area	Intrusion detection area is forcefully armed.
Intrusion detection area input bypass activated	intrusion detection area	Intrusion detection area input bypass is activated.
Intrusion detection area input bypass deactivated	intrusion detection area	Intrusion detection area input bypass is deactivated.
Intrusion detection area input trouble	intrusion detection area	Intrusion detection area input trouble.
Intrusion detection area master armed	intrusion detection area	Intrusion detection area is master armed.
Intrusion detection area master arm request	intrusion detection area	Intrusion detection area master arm request is issued.
Intrusion detection area perimeter armed	intrusion detection area	Intrusion detection area is perimeter armed.
Intrusion detection area perimeter arm request	intrusion detection area	Intrusion detection area perimeter arm request is issued.
Intrusion detection area postponed arming request	intrusion detection area	Intrusion detection area arming request is postponed.
Intrusion detection unit input bypass activated	intrusion detection unit	Intrusion detection unit input bypass is activated.
Intrusion detection unit input bypass deactivated	intrusion detection unit	Intrusion detection unit input bypass is deactivated.
Intrusion detection unit input trouble	intrusion detection unit	Intrusion detection unit input trouble.
Intrusion detection unit tamper	intrusion detection unit	Intrusion detection unit has been tampered with.
Invalid configuration in unit	video unit	The configuration of the unit is invalid.
Invalid custom encryption values	Archiver or Auxiliary Archiver role	This warning is issued by the Archiver on start-up and every 5 minutes if one of the custom encryption values (initial fingerprint or encryption key) specified in the Server Admin is invalid.
Inventory reset	parking zone	The inventory of a parking zone has been reset to zero so that the reported parking zone occupancy can be re-initialized.
Last person out	area	The last cardholder has exited an area.
License plate hit	Any hit rule	A license plate read has been matched to a hotlist, an overtime rule, or a permit restriction.
License plate read	LPR unit or Genetec Patroller™	A license plate has been read.
Live bookmark added	camera	A user has added a bookmark to a live video.
Lock released	zone	Event related to a zone entity.
Lock secured	zone	Event related to a zone entity.
Loitering	camera (video analytics)	Loitering activity has been detected in the camera footage.
Low battery	asset	The battery on the RFID tag of an asset is about to run out.
Macro aborted	macro	Execution of a macro has failed.
Macro started	macro	Execution of a macro has begun.
Manual station activated	door	Someone has pulled the door emergency release (manual pull station).
Manual station reverted to normal state	door	The door emergency release (manual pull station) has been restored to it normal operating position.
Macro completed	macro	Execution of a macro has been completed normally.
Missing tail host	door	The tail host of a two-host visitor delegation did not badge.
Motion	camera	There is motion detected.
Motion off	camera	This event is issued following a Motion on event when motion (measured in terms of number of motion blocks) has dropped below the “motion off threshold” for at least 5 seconds.
Motion on	camera	This event is issued when positive motion detection has been made.
Multiple units are configured for the interlock	area	All doors that are part of an interlock configuration must be controlled by the same unit.
No entry detected	cardholder or door	A cardholder was granted access to a door or area, but no entry is detected. For this event to be generated, you must configure a door sensor on the door side where you want entry to be detected.
No match	hotlist	A vehicle has not been matched to the hotlist associated to the Sharp unit.
No RTP packet lost in the last minute	camera	The Archiver has received all the RTP packets in the last minute.
Object condition changed	camera (video analytics)	An object has suddenly changed direction or speed, such as when a person starts running or slips.
Object count changed	camera (video analytics)	A change has been detected in the object count on a camera equipped with video analytics capabilities.
Object count reached	camera (video analytics)	An object count limit has been reached for the object count on a camera equipped with video analytics capabilities.
Object crossed line	camera (video analytics)	An object has crossed a predefined tripwire.
Object detected	camera (video analytics)	An object is in the camera field of view.
Object detected in field	camera (video analytics)	An object has been detected in a zone that is being monitored for intrusion on a camera equipped with video analytics capabilities.
Object direction changed	camera (video analytics)	An object has been detected changing direction on a camera equipped with video analytics capabilities.
Object entered	camera (video analytics)	An object has entered the camera field of view.
Object exited	camera (video analytics)	An object has exited the camera field of view.
Object following route	camera (video analytics)	An object is following a predetermined route, in a specific direction.
Object left	camera (video analytics)	An object has entered and exited the camera field of view.
Object merged	camera (video analytics)	Two separate objects in the camera field of view have merged.
Object removed	camera (video analytics)	An object has been removed from the camera field of view.
Object separated	camera (video analytics)	An object within the camera field of view has separated into two objects.
Object stopped	camera (video analytics)	A moving object has stopped.
Object velocity changed	camera (video analytics)	An object has been detected changing speed on a camera equipped with video analytics capabilities.
Offload failed	Genetec Patroller™	An offload from Genetec Patroller™ to Security Center has failed.
Offload successful	Genetec Patroller™	An offload from Genetec Patroller™ to Security Center was successful.
Paid time started	parking rule	Parking time has been purchased through connected pay stations or mobile apps.
People counting disabled: Unit is offline	area	A unit has gone offline, thus disabling people counting.
People count reset	area	The number of people counted in an area has been reset to 0.
Person falling	camera (video analytics)	A person falling has been detected in the camera.
Person running	camera (video analytics)	A person running has been detected in the camera.
Person sliding	camera (video analytics)	A person sliding has been detected in the camera.
Playback bookmark added	camera	A user has added a bookmark to a recorded video.
Protection threshold exceeded	Archiver or Auxiliary Archiver role	The Protected video threshold configured from the Archiver has been exceeded. You can monitor the percentage of disk space occupied by protected video files from the Statistics page in the Archiver's Resources tab in Config Tool.
PTZ activated	camera (PTZ)	A user started using the PTZ after it has been idle. The field indicates the user who activated the PTZ. This event is regenerated every time a different user takes control of the PTZ, even when the PTZ is still active.
PTZ locked	camera (PTZ)	A user has tried to move the PTZ while it is being locked by another user with a higher PTZ priority. The field indicates the machine, application type, and user who currently holds the lock.
PTZ stopped	camera (PTZ)	The PTZ has not been manipulated by any user after a predetermined period of time. The field indicates the user who last used the PTZ.
PTZ zoom by user	camera (PTZ)	A user started zooming the PTZ. The Description field indicates the user who performed the zoom. Subsequent PTZ zoom by user events are generated if another user zooms the PTZ, or if the original user zooms the PTZ after the Idle delay has expired.
PTZ zoom by user stopped	camera (PTZ)	The PTZ has not been zoomed by any user after a predetermined period of time. The field indicates the user who last zoomed the PTZ.
Receiving RTP packets from multiple sources	camera	The Archiver is receiving more than one video stream for the same camera. IMPORTANT: When this rare situation arises, the Archiver cannot tell which stream is the correct stream by looking at the source IP address because of the NAT (Network Address Translation), so an arbitrary choice is made. This can result in the wrong video stream being archived. However, the source IP address and port number of both streams are indicated in the field, and the two sources are labeled and . You can find the faulty unit that is causing this conflict.
Recording problem	camera	There is a problem recording the camera. The problem might be due to an error writing to disk, an error writing to the Archiver database, or the fact that the camera is not streaming video when it should.
Recording started (alarm)	camera	The recording on a camera has been started as the result of an alarm being triggered.
Recording started (continuous)	camera	The recording on a camera has been started by a continuous archiving schedule.
Recording started (external)	camera	The recording on a camera has been started by the Start recording action. This action could have been triggered by another event or executed from a macro.
Recording started (motion)	camera	The recording on a camera has been started through motion detection.
Recording started (user)	camera	The recording on a camera has been started manually by a user.
Recording stopped (alarm)	camera	The recording on a camera has stopped because the alarm recording time has elapsed.
Recording stopped (continuous)	camera	The recording on a camera has stopped because it is no longer covered by a continuous archiving schedule.
Recording stopped (external)	camera	The recording on a camera has been stopped by the Stop recording action. This action could have been triggered by another event or executed from a macro.
Recording stopped (motion)	camera	The recording on a camera has stopped because the motion has ceased.
Recording stopped (user)	camera	The recording on a camera has been stopped manually by a user.
Request to exit	door	Someone has pressed the door release button or has triggered a request to exit motion detector. The Request to exit event has special filtering to make this feature compatible with motion detection request to exit hardware. Set these properties in the Config Tool > Door > Properties tab.
Request to exit normal	door	No request to exit is being made.
RTP packets lost	camera	There are RTP packets that the Archiver never received. This could happen if the packets have been lost on the network, or if the Archiver does not have enough CPU to process all the packets received on the network card. The field indicates the number of packets lost since the last time this event was issued (no more than once every minute).
Scheduled controlled access	elevator	The schedule for controlled access to elevator floors now applies.
Scheduled free access	elevator	The schedule for free access to elevator floors now applies.
Scheduled lock	door	The door unlock schedule has expired, the lock is now re-asserted (door is locked).
Scheduled unlock	door	The door lock is unlocked due to a programmed unlock schedule.
Schedule unlock ignored: first-person-in rule supervisor absent	door	The door unlock schedule is ignored because the restriction imposed by the first-person-in rule has not yet been satisfied.
Session completed	parking rule	The vehicle has exited the parking zone.
Session started	parking rule	The vehicle has entered the parking zone.
Signal lost	camera	The camera signal has been lost.
Signal recovered	camera	The camera signal has been recovered.
Synchronization completed: External system	Active Directory role	The synchronization of an external system has completed.
Synchronization error: External system	Active Directory role	The synchronization of an external system has resulted in an error.
Synchronization started: External system	Active Directory role	The synchronization of an external system has started.
Tailgating	camera (video analytics)	Two people have entered a secured area following each other very closely.
Temperature alarm	video unit	The temperature of the video unit has risen above the safety level.
Threat level cleared	threat level	A threat level has been cleared.
Threat level set	threat level	A threat level has been set.
Transmission lost	camera	The Archiver is still connected to the camera, but it has not received any video packets for more than 5 seconds.
Transmission recovered	camera	The Archiver has started to receive video packets from the camera again.
Undefined video analytics event	camera (video analytics)	A generic video analytic event has been issued, but it is not yet mapped to a Security Center event. TIP: You can check for additional sub-type information in the analytic metadata.
Unit connected	unit	The connection to a unit has been established or restored.
Unit failed to respond to edge video request	camera	Event related to a camera that is recording directly on the unit.
Unit lost	unit	The connection to a unit has been lost.
Unit synchronization failed	access control unit	The synchronization of the unit with the Access Manager has failed.
Unit synchronization started	access control unit	The synchronization of the unit with the Access Manager has started.
Unit synchronization succeeded	access control unit	The synchronization of the unit with the Access Manager has completed successfully.
Updated published	Genetec Patroller™, Mobile Sharp	An update has been processed, and is ready to be deployed to Genetec Patroller™.
Update failed	Genetec Patroller™, Mobile Sharp	An update on Genetec Patroller™ or a Mobile Sharp unit has failed, or a file could not be synchronized on a Genetec Patroller™ computer.
Update installation completed	Genetec Patroller™, Mobile Sharp	An update has completed on Genetec Patroller™ or a Mobile Sharp unit, and no reboot is required.
Update installation started	Genetec Patroller™, Mobile Sharp	A user has started an updated on Genetec Patroller™ by clicking the “Update” icon.
Update uninstallation completed	Genetec Patroller™, Mobile Sharp	A rollback on Genetec Patroller™ or a Mobile Sharp unit has completed.
Update uninstallation started	Genetec Patroller™, Mobile Sharp	A user has started a rollback on Genetec Patroller™ by clicking the “Rollback” icon.
User logged off	user	A user has logged off of a Security Center application.
User logged on	user	A user has logged on to a Security Center application.
Validating paid time	parking rule	The convenience time or the paid time has expired for the parking session.
Violation detected	parking rule	The convenience time, the grace period, or the paid time has expired for the parking session.
Violation enforced	parking rule	The vehicle in violation has been ticketed.
Visitor astray	door	A visitor did not badge within the allotted time after the delegation's host or a previous visitor.
VRM connection attempt	Archiver role	The Archiver has attempted to connect to a VRM unit.
VRM connection failure	Archiver role	The Archiver has failed to connect to a VRM unit.
Window closed	zone	A physical window has closed.
Window opened	zone	A physical window has opened.
Zone armed	zone	A zone has been armed.
Zone disarmed	zone	A zone has been disarmed.
Zone maintenance completed.	I/O zone	An I/O zone has been taken out of maintenance mode.
Zone maintenance started	I/O zone	An I/O zone has been put into maintenance mode.
Zone offline	I/O zone	An I/O zone is offline.

For a list of events that can be used with KiwiVision™ video analytics, see "Events to monitor in Security Desk" in the KiwiVision™ Video Analytics Guide.