Log Reference

Watchdog Logs

Note: A few WD codes are emitted from more than one place in Watchdog (for example, WD1001, WD3001, WD1005). Each occurrence is listed as its own row below.

Log ID	Log Level	Message	Description
WD1001	ERROR	Error reading SSL certificate:	Logs when there is an error reading the SSL certificate from the file.
WD1001	DEBUG	Entering CheckLicenseView post method.	Logs the entry into the /api/check-license/ handler.
WD1002	WARNING	Invalid license.	Logs a warning when the license check fails during a check-license request.
WD1003	DEBUG	Controller Version	Logs the controller version being processed in the check-license request.
WD1004	INFO	Hostname: {hostname}, Version: {version}, IP_LIST: {ip_list}, MAC: {mac}, OS: {os}, Label: {label}	Emitted alongside WD2003 when a new controller registers — records the full controller payload.
WD1005	DEBUG	Entering GenerateGuidFile get method.	Logs the entry into the /api/get-licenses/ handler.
WD1005	INFO	{n}/{max}: Controllers registered in Watchdog.	Logs the running registered-controller count after a successful registration.
WD1006	WARNING	Invalid license.	Logs a warning when the license check fails during a get-licenses request.
WD1007	DEBUG	Exiting GenerateGuidFile get method.	Logs the exit from the /api/get-licenses/ handler.
WD1010	INFO	{days_remaining} days remaining until SSL certificate expiration.	Logs the number of days remaining before the SSL certificate expires if more than 60 days are left.
WD1011	WARNING	Only {days_remaining} days remaining until SSL certificate expiration. Kindly renew your certificate.	Warns the user to renew the SSL certificate if less than 60 days are remaining.
WD1020	ERROR	Unable to determine SSL certificate expiration date.	Logs an error if the SSL certificate expiration date cannot be determined.
WD2001	DEBUG	Entering validate_license function.	Logs entry into the license validation function.
WD2001	ERROR	Invalid GUID format.	Logs an error when the controller GUID is not a valid UUIDv4.
WD2002	WARNING	Limit Reached! Please upgrade your license then Try Again	Logs a warning when the number of active devices reaches the licensed limit.
WD2003	INFO	Controller Registered! GUID: {guid}, IP: {ip}	Logs the registration of a new controller (full payload follows in WD1004).
WD2010	INFO	License is valid, verification completed successfully.	Logs successful verification of the license.
WD2021	ERROR	Invalid Auth Code!	Logs when the authentication code provided in the license key is invalid.
WD2030	ERROR	Verification Failed! Invalid BMKEY Format!	Logs when the format of the BMKEY is invalid, causing the license validation to fail.
WD2040	ERROR	Verification Error: {str(e)}!	Logs errors encountered during the license verification process.
WD2050	ERROR	Verification Failed! Please use the provided key!	Logs a general failure in license verification if the key used does not work as expected.
WD2070	ERROR	License is expired!	Watchdog exits with this message when the license expiry date has passed.
WD2099	DEBUG	Exiting validate_license function.	Logs exit from the license validation function.
WD2101	INFO	SSL certificate and key generated: {cert_file}, {key_file}	Logs the generation of SSL certificate and key files.
WD2201	INFO	Scheduler Started	Logs the start of the background scheduler.
WD3001	ERROR	Cloud mode not valid!	Logs when the licensing mode is set to cloud, which is not supported.
WD3001	ERROR	{Field} is required.	Logs when a required field is missing from a check-license request (guid, hostname, etc.).
WD3002	ERROR	Please use the appropriate licensing mode!	Logs when an incorrect licensing mode is selected.

ETI Logs

Log ID	Log Level	Message	Description
ETI1001	ERROR	ETI1001: Error parsing JSON line:	Logs when a line in the decrypted ETI data cannot be parsed as valid JSON.
ETI2001	WARNING	ETI2001: Config file {self.config_path} not found	Logs when the configuration file does not exist and defaults/fallbacks will be used.
ETI2002	ERROR	ETI2002: Proxy mode enabled but no valid proxy URLs found	Logs when proxy mode is enabled but neither HTTP nor HTTPS proxy is configured.
ETI2003	ERROR	ETI2003: Missing required environment variables	Logs when one or more required environment variables for Elasticsearch connection are missing.
ETI2004	ERROR	ETI2004: Configuration error:	Logs when a general configuration error occurs during loading or validation.
ETI2005	ERROR	ETI2005: Failed to create Elasticsearch client:	Logs when the Elasticsearch client cannot be created due to invalid config or connection issues.
ETI3001	INFO	ETI3001: Proxies configured:	Logs when proxy mode is enabled and HTTP/HTTPS proxies are configured for the session.
ETI4001	ERROR	ETI4001: Request failed for {url}: {e}	Logs when an HTTP request fails due to network issues, timeout, or invalid response status.
ETI5001	INFO	ETI5001: Successfully downloaded from	Logs when data is successfully downloaded from the given URL.
ETI5002	WARNING	ETI5002: Download attempt {attempt + 1} failed for {url}: {e}	Logs when a single download attempt fails due to network or server issues.
ETI5003	INFO	ETI5003: Retrying in {self.RETRY_DELAY} seconds...	Logs when the system will retry the download after a delay.
ETI5004	ERROR	ETI5004: All download attempts failed for	Logs when all retry attempts fail and the download cannot be completed.
ETI6001	ERROR	ETI6001: Error parsing date string:	Logs when the given date string cannot be parsed into a standard datetime format.
ETI6002	ERROR	ETI6002: Error comparing date:	Logs when the given date string cannot be parsed or compared against the threshold date.
ETI8001	INFO	ETI8001: Rollover successful for alias:	Logs when the rollover operation is successfully acknowledged by Elasticsearch.
ETI8002	INFO	ETI8002: New index created:	Logs the name of the new index created after a successful rollover.
ETI8003	WARNING	ETI8003: Rollover response for alias {alias}: {response}	Logs when the rollover operation returns a non-acknowledged response.
ETI8004	ERROR	ETI8004: Error during rollover for alias {alias}: {e}	Logs when an exception occurs during the rollover operation.
ETI8005	ERROR	ETI8005: Error getting current index:	Logs when an exception occurs while retrieving the current active threat-index from Elasticsearch.
ETI8006	INFO	ETI8006: Index {index_name} contains {doc_count} documents	Logs the document count of the specified index when checked.
ETI8007	ERROR	ETI8007: Error checking document count in index {index_name}: {e}	Logs when an exception occurs while retrieving the document count from Elasticsearch.
ETI8008	ERROR	ETI8008: Error generating bulk actions:	Logs when an exception occurs while generating bulk indexing actions from ETI data.
ETI9001	INFO	ETI9001: No ETI data to insert	Logs when there is no ETI data available for insertion into Elasticsearch.
ETI9002	INFO	ETI9002: Inserting {len(eti_data)} records into Elasticsearch	Logs when the bulk insert operation is starting, including record count.
ETI9003	INFO	ETI9003: Inserting data into index:	Logs the index name where data will be inserted.
ETI9004	WARNING	ETI9004: No valid actions generated for bulk insert	Logs when no valid bulk actions were generated for insertion.
ETI9005	INFO	ETI9005: Bulk insert completed: {success} successful, {len(errors)} errors	Logs the result of the bulk insert operation, including successes and errors.
ETI9006	ERROR	ETI9006: Bulk insert errors (first 5):	Logs the first few errors returned from the bulk insert operation.
ETI9007	ERROR	ETI9007: Error during bulk insert:	Logs when an unexpected exception occurs during the bulk insert operation.
ETI8009	INFO	ETI8009: Checking indices for deletion (threshold: {date})	Logs the start of the index deletion check and shows the threshold date.
ETI8010	WARNING	ETI8010: Skipping {index}: No creation_date found	Logs when an index is skipped because it does not have a creation date.
ETI8011	INFO	ETI8011: Deleted old index: {index} (created: {date})	Logs when an old index is successfully deleted.
ETI8012	WARNING	ETI8012: Error processing index {index}: {error}	Logs when an error occurs while processing a specific index.
ETI8013	INFO	ETI8013: Deleted {count} old indices	Logs the total number of indices deleted after the cleanup run.
ETI8014	ERROR	ETI8014: Error deleting old indices:	Logs when the deletion routine fails due to a fatal error.
ETI1100	ERROR	ETI1100: Error generating auth hash:	Logs when SHA3-512 hash generation fails due to an unexpected error.
ETI1101	ERROR	ETI1101: Failed to generate auth hash:	Raised as an ETIDataError when authentication hash cannot be generated.
ETI1102	WARNING	ETI1102: ⚠️ No checksum header provided by server	Logs when the server response does not include a checksum header.
ETI1103	ERROR	ETI1103: ❌ Checksum mismatch! Local={local_checksum}, Server={server_checksum}	Logs when calculated checksum differs from the server-provided checksum.
ETI1104	INFO	ETI1104: Checksum verified successfully ({local_checksum})	Logs when checksum verification succeeds and the data integrity is ensured.
ETI2100	ERROR	ETI2100: Checksum mismatch (local={local_checksum}, server={checksum_header})	Raised as a NetworkError when checksum validation fails for the response.
ETI2101	WARNING	ETI2101: Download attempt {attempt} failed: {error}	Logs when an individual download attempt fails due to a network error.
ETI2102	INFO	ETI2102: Retrying in {delay} seconds...	Logs when the system waits before retrying a failed download attempt.
ETI2103	ERROR	ETI2103: All download attempts failed for ETI API	Logs when all retries are exhausted and data could not be downloaded.
ETI2104	INFO	ETI2104: Starting ETI data collection	Logs when the ETI data collection process begins.
ETI2105	WARNING	ETI2105: Failed to download ETI data	Logs when encrypted ETI data could not be downloaded.
ETI2106	INFO	ETI2106: No new ETI data to process	Logs when the decrypted ETI dataset is empty or contains no new records.
ETI2107	INFO	ETI2107: ETI data collection completed successfully.	Logs when ETI data has been successfully inserted into Elasticsearch.
ETI2108	ERROR	ETI2108: Failed to insert ETI data.	Logs when ETI data decryption succeeds but bulk insertion into ES fails.
ETI2109	ERROR	ETI2109: ETI data collection failed:	Logs unexpected errors with traceback during ETI data collection.
ETI4000	INFO	ETI4000: Starting threat intelligence collection pipeline	Logs when the full ETI pipeline execution begins.
ETI4001	INFO	ETI4001: Active index is not empty. Skipping data processing	Logs when the active Elasticsearch index already contains data, so ingestion is skipped.
ETI4002	INFO	ETI4002: Pipeline execution completed successfully	Logs when the ETI pipeline completes all steps without errors.
ETI4003	ERROR	ETI4003: Pipeline execution failed:	Logs unexpected errors during the ETI pipeline execution.
ETI4004	INFO	ETI4004: Starting threat collector scheduler	Logs when the scheduler service begins execution.
ETI4005	INFO	ETI4005: Next run scheduled in {seconds_until_next_run:.0f} seconds	Logs how many seconds until the next scheduled pipeline run.
ETI4006	INFO	ETI4006: Scheduler stopped by user	Logs when the scheduler is stopped via user interrupt (KeyboardInterrupt).
ETI4007	ERROR	ETI4007: Pipeline execution failed:	Logs errors during scheduled pipeline execution but keeps scheduler alive.
ETI4008	INFO	ETI4008: Service cleanup completed	Logs when all resources (e.g., HTTP sessions) are cleaned up successfully.
ETI4009	ERROR	ETI4009: Error during cleanup:	Logs when an error occurs while cleaning up resources.
ETI9000	INFO	ETI9000: Service stopped by user	Logs when the service is manually stopped by the user (KeyboardInterrupt).
ETI9001	ERROR	ETI9001: Service failed to start:	Logs when the service fails to start due to an unexpected exception.
ETI3308	INFO	ETI3308: Making request to: {full_url}	Logs full url to which threat-collector sends get request.

UCS Logs

Note: Codes marked raised are validation errors carried in an exception rather than written straight to the log file. They reach ucs_client.log through the retry warning (UCS5003) or the final failure line (UCS8008), with the original message attached.

Log ID	Log Level	Message	Description
UCS1001	ERROR	UCS1001: Missing required environment variables	Raised when one or more critical environment variables are not set.
UCS1002	WARNING	UCS1002: Config file {config_path} not found	Logs when the expected UCS client config file is missing.
UCS1003	ERROR	UCS1003: UCS updates enabled but authcode not provided	Raised when UCS updates are enabled but no authentication code is provided.
UCS1004	ERROR	UCS1004: Proxy mode enabled but no valid proxy URLs found	Raised when proxy mode is enabled but no HTTP/HTTPS proxy URLs are given.
UCS1005	ERROR	UCS1005: Configuration error:	Raised for any other unexpected error while loading configuration.
UCS2005	ERROR	UCS2005: Failed to create Elasticsearch client:	Raised when the Elasticsearch client cannot be created.
UCS3001	INFO	UCS3001: Proxies configured:	Logs the proxies applied to the HTTP session when proxy mode is enabled.
UCS3002	INFO	UCS3002: Loaded last domain ID from Elasticsearch:	Logs the checkpoint (highest indexed domain ID) read from Elasticsearch at the start of a sync.
UCS3004	INFO	UCS3004: No documents found in Elasticsearch, starting with domain ID: 0	Logs when the index is empty, so the sync starts from domain ID 0.
UCS3005	WARNING	UCS3005: Failed to load last domain ID from Elasticsearch: {exception}. Returning 0	Logs when the checkpoint cannot be read and the sync falls back to domain ID 0.
UCS3007	ERROR	UCS3007: Error generating auth hash:	Logs an error when SHA3-512 hash generation fails.
UCS3008	ERROR	UCS3008: Failed to generate auth hash:	Raised when the authentication hash cannot be generated.
UCS3308	INFO	UCS3308: Requesting {url} for domain_id>{domain_id} (auth_hash redacted)	Logs the outgoing sync request. The authentication hash is deliberately omitted from the log line.
UCS4001	ERROR	UCS4001: Request failed for {url}: {exception}	Logs and raises a network error when the HTTP request to the UCS API fails.
UCS5001	INFO	UCS5001: Connected to UCS /v2 request_id={request_id} checkpoint={checkpoint_end}	Logs a successful connection to the UCS API, with the server request ID and the checkpoint it will deliver up to.
UCS5002	INFO	UCS5002: /v2 progress request_id={request_id} records={count} received_bytes={bytes} rate={rate} MiB/s	Periodic download progress, emitted every two seconds while a sync is streaming.
UCS5003	WARNING	UCS5003: /v2 synchronization attempt {attempt}/{max} failed: {exception}	Logs a failed sync attempt, including the underlying reason.
UCS5004	INFO	UCS5004: Retrying from domain ID {domain_id} in {delay} seconds	Logs that the client will retry the sync from the same checkpoint after a delay.
UCS5005	ERROR	UCS5005: All UCS /v2 synchronization attempts failed	Logs that every retry attempt has been exhausted without a completed sync.
UCS5008	ERROR	UCS5008: Authentication hash is not valid hexadecimal	Raised when the authentication hash is malformed and the session key cannot be derived.
UCS5009	ERROR	UCS5009: Authentication hash must be a SHA3-512 value	Raised when the authentication hash is not the expected 64-byte length.
UCS5010	ERROR	UCS5010: Response is not a UCS v4 stream; missing headers:	Raised when the server response is missing the headers required to decode a v4 stream.
UCS5011	ERROR	UCS5011: Unsupported UCS key version:	Raised when the server advertises a key version this client cannot read.
UCS5012	ERROR	UCS5012: UCS v4 response headers are malformed	Raised when the response headers are present but cannot be decoded.
UCS5013	ERROR	UCS5013: X-Export-Salt must not be empty	Raised when the server omits the salt needed to derive the session key.
UCS5014	ERROR	UCS5014: X-Nonce-Base must decode to 4 bytes	Raised when the nonce base sent by the server is the wrong size.
UCS5015	ERROR	UCS5015: X-Checkpoint-End must not be negative	Raised when the server advertises an invalid checkpoint.
UCS5016	ERROR	UCS5016: Server checkpoint precedes the requested domain ID	Raised when the server offers a checkpoint older than the one already indexed, which would move the sync backwards.
UCS5017	ERROR	UCS5017: Server advertised new data but returned no valid records	Raised when the checkpoint moved forward but the stream contained no usable records.
UCS5018	ERROR	UCS5018: Completed stream does not contain the advertised checkpoint record (observed={observed}, checkpoint={n})	Raised when the highest record received does not match the checkpoint the server promised — the sync is incomplete.
UCS6003	ERROR	UCS6003: Invalid JSONL record in UCS v4 stream	Raised when a record in the stream is not valid JSON.
UCS6004	ERROR	UCS6004: UCS v4 record must be a JSON object	Raised when a decoded record is not a JSON object.
UCS6005	ERROR	UCS6005: UCS v4 record is missing a numeric domainId	Raised when a record has no usable domainId field.
UCS6006	ERROR	UCS6006: Data received after UCS stream completion	Raised when the server sends more data after the stream was already finalized.
UCS6007	ERROR	UCS6007: Invalid encrypted UCS frame length	Raised when a frame header declares a length too small to be valid.
UCS6008	ERROR	UCS6008: Encrypted UCS frame is unreasonably large	Raised when a frame exceeds the 64 MiB safety limit, guarding against a malformed or hostile response.
UCS6009	ERROR	UCS6009: UCS v4 frame authentication failed	Raised when a frame fails its integrity check — the data was corrupted or tampered with in transit.
UCS6010	ERROR	UCS6010: Invalid UCS v4 gzip stream	Raised when the decrypted payload cannot be decompressed.
UCS6011	ERROR	UCS6011: UCS v4 stream was finalized more than once	Raised when the stream decoder is finalized twice.
UCS6012	ERROR	UCS6012: Download ended with {n} incomplete frame bytes	Raised when the connection ended mid-frame, leaving a partial download.
UCS6013	ERROR	UCS6013: UCS v4 gzip finalization failed	Raised when the compressed stream cannot be closed cleanly.
UCS6014	ERROR	UCS6014: UCS v4 gzip stream ended prematurely	Raised when the stream ends before the compressed data is complete.
UCS6015	ERROR	UCS6015: Unexpected bytes follow the UCS v4 gzip stream	Raised when trailing bytes appear after the end of the compressed data.
UCS7006	ERROR	UCS7006: Elasticsearch accepted {success}/{total} records; errors={errors}	Raised when Elasticsearch rejects part of a batch. Includes up to five example errors.
UCS7007	ERROR	UCS7007: Elasticsearch bulk insertion failed:	Raised when a bulk insert into Elasticsearch fails outright.
UCS8001	INFO	UCS8001: UCS updates are disabled in configuration. Skipping UCS sync.	Logs when UCS sync is skipped because updates are disabled in configuration.
UCS8002	INFO	UCS8002: Starting UCS /v2 data collection	Logs the start of the UCS data collection process.
UCS8003	WARNING	UCS8003: UCS /v2 synchronization did not complete	Logs when the sync could not be completed after all retries.
UCS8004	INFO	UCS8004: No new UCS records; checkpoint remains	Logs when the client is already up to date and there was nothing new to index.
UCS8005	INFO	UCS8005: UCS /v2 synchronization completed: records={count} checkpoint={checkpoint_end} received_bytes={bytes}	Logs a successful sync, with the number of records indexed and the new checkpoint.
UCS8008	ERROR	UCS8008: UCS data collection failed:	Logs and re-raises an unhandled error during UCS data collection.
UCS9000	INFO	UCS9000: Starting UCS client scheduler	Logs when the UCS scheduler service starts running.
UCS9001	INFO	UCS9001: Next UCS sync scheduled in {seconds} seconds	Logs the number of seconds until the next scheduled UCS sync at 00:15.
UCS9002	INFO	UCS9002: Scheduler stopped by user	Logs when the scheduler is manually interrupted (Ctrl+C / KeyboardInterrupt).
UCS9003	ERROR	UCS9003: UCS collection failed:	Logs unexpected errors during a scheduled UCS collection but keeps the scheduler running.
UCS1101	INFO	UCS1101: UCS client cleanup completed	Logs successful cleanup of UCS client resources (e.g., session close).
UCS1102	ERROR	UCS1102: Error during cleanup:	Logs errors that occur while cleaning up UCS client resources.
UCS2101	INFO	UCS2101: UCS client stopped by user	Logs when the UCS client is stopped manually (KeyboardInterrupt).
UCS2102	ERROR	UCS2102: UCS client failed to start:	Logs and exits when the UCS client fails to start due to an unexpected error.