Event Logging

When you use Intel Packet Protect for secure communications, it produces certain log messages that are placed in a log. These messages report various events that occur when you use Intel Packet Protect. These messages can be informational or can report errors and warnings. 

Logging these events is optional. You can choose whether you want to log events all the time or if you only want to log events for special reasons. The information in the log can be very helpful in diagnosing and fixing problems with Intel Packet Protect. If you are experiencing problems communicating securely with Intel Packet Protect, you may want to enable logging to help solve the problem.

How do I enable event logging?

About Log Entries

Some events are logged when you use Intel Packet Protect. Events on Windows NT*-based systems are also logged in the NT Event Log, along with all other Windows NT events. Events on Windows 98- or Windows ME-based systems are logged in the Intel Packet Protect Log.

How do I view the Intel Packet Protect Log?

How do I view log entries in Windows NT Event Log?

Types of Log Entries

Use this table to understand the three different types of log entries. Intel Packet Protect log entries will be one of these types.

Format of Log Entries

The log entries are listed in order of occurrence, like this:

{93} 2001/01/15 19:25:36.328 <0/7/1610620928> [logger]Intel Logger started
{169} 2001/01/15 19:25:57.067 <1/7/1610616832> [PAgent]Intel Policy Agent Service started

Log entries have the following format: 

{ThreadID} YYYY/MM/DD hh:mm:ss.msec <Type /Severity/Message ID> [Component] Error Message
Thread ID  This is the system-assigned serial number for the thread that generated this message. 
Type  This is always set to 1 (Information 1, status 2, warning 3, error 4)
Severity  This identifies the severity of the message. This is normally set to "6" or "7". 
Message ID  This is the Message ID assigned by Intel Packet Protect. It is used for debugging. 
Component  This is the software identity that reported the message. 

Intel Packet Protect Log Entries

Information logs

If you receive any informational event, you do not need to take any action as long as the machines are still communicating under policy. 

Text of Event Explanation Resolution
Policy Agent Service Stopped. PolicyAgent was stopped. The system will not perform IPSec operations and will communicate to peers in the clear (if the peers are configured compatibly). No action needed.
Intel Policy Agent Service Started PolicyAgent was started successfully. The system is ready to communicate with peers using IPSec (if the peers are configured compatibly). No action needed.
Exception file pagent.exe, being created – Unhandled Exception There was an exception in the Policy Agent process. No action needed.
IPSec Object Failed Instantiation <failure code>

Could not instantiate IPSec. Reasons for this error could be:

  • IPSec.dll is not registered.
  • IPSec is NOT enabled on any of the adapters in the machine.
  • The TCP/IP stack is not setup correctly.

Check if ipsec.dll is registered

Check if IPSec is enabled using PROSet II.

Check if adapter/protocol bindings are correct using Network Properties.

Intel Policy Agent Failed to Start. Policy Agent initialization failed. This is usually a secondary message. IKE or IPSec failed to instantiate.
IKE Object Failed Instantiation <failure code>

Could not instantiate IKE. Reasons for this error could be:

  • In Windows 98, DCOM98 is not installed correctly.
  • CDSA is not installed correctly.
  • IKE.dll is not registered.
 
Re-register IKE. To do this, use Windows Explorer and browse to Program Files\Packet Protect\bin. Right-click on ike.dll and select Open.

If the error message persists, re-install DCOM98 at http://www.microsoft.com/com/dcom/
dcom98/download.asp
.

If the error message persists, check that the CDSA files are intact.

If all else fails, re-install Intel Packet Protect.

Another reason why IKE failed instantiation could be due to the Intel Packet Protect process restarting too quickly after a policy change. The system will automatically recover from this situation, and communication will restart with the new policy.  No action needed. 
IKE Failure: Self <SourceAddress>, Peer <DestinationAddress>, IKE Event <40001> IKE Phase I Timeout

IKE Failure: Self <SourceAddress>, Peer <DestinationAddress>, IKE Event <40002> IKE Phase II Timeout.

Your machine did not get a timely response from a peer on an IKE message. The IKE negotiation will automatically be re-tried.  If the renegotiation does not succeed, check to see if there is a problem with the peer system or the network itself.  
Frequent occurrences of IKE failure messages in the log may occur if you are talking to a peer machine in the clear, as specified in the policy. This is not an erroneous condition. No action needed. 

Copyright © 2001, Intel Corporation. All rights reserved.

Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel make any commitment to update the information contained herein.

* Other product and corporate names may be trademarks of other companies and are used only for explanation and to the owners' benefit, without intent to infringe.