Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Nested Classes](https://developer.android.com/reference/android/app/admin/SecurityLog#nestedclasses) \| [Constants](https://developer.android.com/reference/android/app/admin/SecurityLog#constants) \| [Ctors](https://developer.android.com/reference/android/app/admin/SecurityLog#pubctors) \| [Inherited Methods](https://developer.android.com/reference/android/app/admin/SecurityLog#inhmethods) # SecurityLog *** ** * ** *** ` public class SecurityLog ` ` extends https://developer.android.com/reference/java/lang/Object ` ` ` |---|---| | [java.lang.Object](https://developer.android.com/reference/java/lang/Object) || | ↳ | android.app.admin.SecurityLog |
*** ** * ** *** Definitions for working with security logs. Device owner apps can control the logging with `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setSecurityLoggingEnabled(android.content.ComponentName,%20boolean)`. When security logs are enabled, device owner apps receive periodic callbacks from `https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onSecurityLogsAvailable(android.content.Context,%20android.content.Intent)`, at which time new batch of logs can be collected via `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#retrieveSecurityLogs(android.content.ComponentName)`. `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent` describes the type and format of security logs being collected. ## Summary | ### Nested classes || |---|---| | ` class` | `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent` A class representing a security event log entry. | | ### Constants || |---|---| | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#LEVEL_ERROR` Event severity level indicating that the event requires urgent admin action. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#LEVEL_INFO` Event severity level indicating that the event corresponds to normal workflow. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#LEVEL_WARNING` Event severity level indicating that the event may require admin attention. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_ADB_SHELL_CMD` Indicates that a shell command was issued over ADB via `adb shell ` The log entry contains a `String` payload containing the shell command, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_ADB_SHELL_INTERACTIVE` Indicates that an ADB interactive shell was opened via "adb shell". | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_APP_PROCESS_START` Indicates that an app process was started. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_BACKUP_SERVICE_TOGGLED` Indicates that an admin has enabled or disabled backup service. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_BLUETOOTH_CONNECTION` Indicates that the device attempts to connect to a Bluetooth device. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_BLUETOOTH_DISCONNECTION` Indicates that the device disconnects from a connected Bluetooth device. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_CAMERA_POLICY_SET` Indicates that the admin has set policy to disable camera. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_CERT_AUTHORITY_INSTALLED` Indicates that a new root certificate has been installed into system's trusted credential storage. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_CERT_AUTHORITY_REMOVED` Indicates that a new root certificate has been removed from system's trusted credential storage. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_CERT_VALIDATION_FAILURE` Indicates a failure to validate X.509v3 certificate. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_CRYPTO_SELF_TEST_COMPLETED` Indicates that cryptographic functionality self test has completed. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEYGUARD_DISABLED_FEATURES_SET` Indicates that an admin has set disabled keyguard features. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEYGUARD_DISMISSED` Indicates that keyguard has been dismissed. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT` Indicates that there has been an authentication attempt to dismiss the keyguard. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEYGUARD_SECURED` Indicates that the device has been locked, either by the user or by a timeout. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEY_DESTRUCTION` Indicates that a cryptographic key was destroyed. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEY_GENERATED` Indicates that a cryptographic key was generated. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEY_IMPORT` Indicates that a cryptographic key was imported. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEY_INTEGRITY_VIOLATION` Indicates a failed cryptographic key integrity check. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_LOGGING_STARTED` Indicates start-up of audit logging. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_LOGGING_STOPPED` Indicates shutdown of audit logging. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_LOG_BUFFER_SIZE_CRITICAL` Indicates that the audit log buffer has reached 90% of its capacity. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_MAX_PASSWORD_ATTEMPTS_SET` Indicates that an admin has set a maximum number of failed password attempts before wiping data. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_MAX_SCREEN_LOCK_TIMEOUT_SET` Indicates that an admin has set a maximum screen lock timeout. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_MEDIA_MOUNT` Indicates that removable media has been mounted on the device. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_MEDIA_UNMOUNT` Indicates that removable media was unmounted from the device. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_NFC_DISABLED` Indicates that NFC service is disabled. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_NFC_ENABLED` Indicates that NFC service is enabled. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_OS_SHUTDOWN` Indicates that the Android OS has shutdown. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_OS_STARTUP` Indicates that the Android OS has started. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PACKAGE_INSTALLED` Indicates that a package is installed. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PACKAGE_UNINSTALLED` Indicates that a package is uninstalled. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PACKAGE_UPDATED` Indicates that a package is updated. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PASSWORD_CHANGED` Indicates that a user has just changed their lockscreen password. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PASSWORD_COMPLEXITY_REQUIRED` Indicates that an admin has set a password complexity requirement, using the platform's pre-defined complexity levels. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PASSWORD_COMPLEXITY_SET` Indicates that an admin has set a requirement for password complexity. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PASSWORD_EXPIRATION_SET` Indicates that an admin has set a password expiration timeout. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_PASSWORD_HISTORY_LENGTH_SET` Indicates that an admin has set a password history length. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_REMOTE_LOCK` Indicates that an admin remotely locked the device or profile. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_SYNC_RECV_FILE` Indicates that a file was pulled from the device via the adb daemon, for example via `adb pull`. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_SYNC_SEND_FILE` Indicates that a file was pushed to the device via the adb daemon, for example via `adb push`. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_USER_RESTRICTION_ADDED` Indicates that an admin has set a user restriction. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_USER_RESTRICTION_REMOVED` Indicates that an admin has removed a user restriction. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_WIFI_CONNECTION` Indicates that an event occurred as the device attempted to connect to a managed WiFi network. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_WIFI_DISCONNECTION` Indicates that the device disconnects from a managed WiFi network. | | `int` | `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_WIPE_FAILURE` Indicates a failure to wipe device or user data. | | ### Public constructors || |---|---| | ` https://developer.android.com/reference/android/app/admin/SecurityLog#SecurityLog()() ` | ### Inherited methods From class ` https://developer.android.com/reference/java/lang/Object ` ` https://developer.android.com/reference/java/lang/Object` ` https://developer.android.com/reference/java/lang/Object#clone()() ` Creates and returns a copy of this object. ` boolean` ` https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj) ` Indicates whether some other object is "equal to" this one. ` void` ` https://developer.android.com/reference/java/lang/Object#finalize()() ` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. ` final https://developer.android.com/reference/java/lang/Class` ` https://developer.android.com/reference/java/lang/Object#getClass()() ` Returns the runtime class of this `Object`. ` int` ` https://developer.android.com/reference/java/lang/Object#hashCode()() ` Returns a hash code value for the object. ` final void` ` https://developer.android.com/reference/java/lang/Object#notify()() ` Wakes up a single thread that is waiting on this object's monitor. ` final void` ` https://developer.android.com/reference/java/lang/Object#notifyAll()() ` Wakes up all threads that are waiting on this object's monitor. ` https://developer.android.com/reference/java/lang/String` ` https://developer.android.com/reference/java/lang/Object#toString()() ` Returns a string representation of the object. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait()() ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*. ## Constants ### LEVEL_ERROR Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int LEVEL_ERROR ``` Event severity level indicating that the event requires urgent admin action.
Constant Value: 3 (0x00000003) ### LEVEL_INFO Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int LEVEL_INFO ``` Event severity level indicating that the event corresponds to normal workflow.
Constant Value: 1 (0x00000001) ### LEVEL_WARNING Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int LEVEL_WARNING ``` Event severity level indicating that the event may require admin attention.
Constant Value: 2 (0x00000002) ### TAG_ADB_SHELL_CMD Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_ADB_SHELL_CMD ``` Indicates that a shell command was issued over ADB via `adb shell ` The log entry contains a `String` payload containing the shell command, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`. If security logging is enabled on organization-owned managed profile devices, the shell command will be redacted to an empty string.
Constant Value: 210002 (0x00033452) ### TAG_ADB_SHELL_INTERACTIVE Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_ADB_SHELL_INTERACTIVE ``` Indicates that an ADB interactive shell was opened via "adb shell". There is no extra payload in the log event.
Constant Value: 210001 (0x00033451) ### TAG_APP_PROCESS_START Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_APP_PROCESS_START ``` Indicates that an app process was started. The log entry contains the following information about the process encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] process name (`String`) - \[1\] exact start time in milliseconds according to `System.currentTimeMillis()` (`Long`) - \[2\] app uid (`Integer`) - \[3\] app pid (`Integer`) - \[4\] seinfo tag (`String`) - \[5\] SHA-256 hash of the base APK in hexadecimal (`String`) If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.

Constant Value: 210005 (0x00033455) ### TAG_BACKUP_SERVICE_TOGGLED Added in [API level 35](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_BACKUP_SERVICE_TOGGLED ``` Indicates that an admin has enabled or disabled backup service. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] backup service state (`Integer`, 1 for enabled, 0 for disabled)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setBackupServiceEnabled(android.content.ComponentName,%20boolean)` Constant Value: 210044 (0x0003347c) ### TAG_BLUETOOTH_CONNECTION Added in [API level 33](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_BLUETOOTH_CONNECTION ``` Indicates that the device attempts to connect to a Bluetooth device. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] The MAC address of the Bluetooth device (`String`) - \[1\] Whether the connection is successful (`Integer`, 1 if successful, 0 otherwise) - \[2\] Optional human-readable failure reason, empty string if none (`String`)

Constant Value: 210039 (0x00033477) ### TAG_BLUETOOTH_DISCONNECTION Added in [API level 33](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_BLUETOOTH_DISCONNECTION ``` Indicates that the device disconnects from a connected Bluetooth device. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] The MAC address of the connected Bluetooth device (`String`) - \[1\] Optional human-readable disconnection reason, empty string if none (`String`)

Constant Value: 210040 (0x00033478) ### TAG_CAMERA_POLICY_SET Added in [API level 30](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_CAMERA_POLICY_SET ``` Indicates that the admin has set policy to disable camera. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] whether the camera is disabled or not (`Integer`, 1 if it's disabled, 0 if enabled)

Constant Value: 210034 (0x00033472) ### TAG_CERT_AUTHORITY_INSTALLED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_CERT_AUTHORITY_INSTALLED ``` Indicates that a new root certificate has been installed into system's trusted credential storage. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] result (`Integer`, 0 if operation failed, 1 if succeeded) - \[1\] subject of the certificate (`String`). - \[2\] which user the certificate is installed for (`Integer`), only available from version `https://developer.android.com/reference/android/os/Build.VERSION_CODES#R`. If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.
Constant Value: 210029 (0x0003346d) ### TAG_CERT_AUTHORITY_REMOVED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_CERT_AUTHORITY_REMOVED ``` Indicates that a new root certificate has been removed from system's trusted credential storage. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] result (`Integer`, 0 if operation failed, 1 if succeeded) - \[1\] subject of the certificate (`String`). - \[2\] which user the certificate is removed from (`Integer`), only available from version `https://developer.android.com/reference/android/os/Build.VERSION_CODES#R`. If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.
Constant Value: 210030 (0x0003346e) ### TAG_CERT_VALIDATION_FAILURE Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_CERT_VALIDATION_FAILURE ``` Indicates a failure to validate X.509v3 certificate. The log entry contains a `String` payload indicating the failure reason, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`.
Constant Value: 210033 (0x00033471) ### TAG_CRYPTO_SELF_TEST_COMPLETED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_CRYPTO_SELF_TEST_COMPLETED ``` Indicates that cryptographic functionality self test has completed. The log entry contains an `Integer` payload, indicating the result of the test (0 if the test failed, 1 if succeeded) and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`.
Constant Value: 210031 (0x0003346f) ### TAG_KEYGUARD_DISABLED_FEATURES_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEYGUARD_DISABLED_FEATURES_SET ``` Indicates that an admin has set disabled keyguard features. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] disabled keyguard feature mask (`Integer`).

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setKeyguardDisabledFeatures(android.content.ComponentName,%20int)` Constant Value: 210021 (0x00033465) ### TAG_KEYGUARD_DISMISSED Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEYGUARD_DISMISSED ``` Indicates that keyguard has been dismissed. This event is only logged if the device has a secure keyguard. It is logged regardless of how keyguard is dismissed, including via PIN/pattern/password, biometrics or via a trust agent. There is no extra payload in the log event.
**See also:** - `https://developer.android.com/reference/android/app/admin/SecurityLog#TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT` Constant Value: 210006 (0x00033456) ### TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT ``` Indicates that there has been an authentication attempt to dismiss the keyguard. The log entry contains the following information about the attempt encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] attempt result (`Integer`, 1 for successful, 0 for unsuccessful) - \[1\] strength of authentication method (`Integer`, 1 if strong authentication method was used, 0 otherwise)

Constant Value: 210007 (0x00033457) ### TAG_KEYGUARD_SECURED Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEYGUARD_SECURED ``` Indicates that the device has been locked, either by the user or by a timeout. There is no extra payload in the log event.
Constant Value: 210008 (0x00033458) ### TAG_KEY_DESTRUCTION Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEY_DESTRUCTION ``` Indicates that a cryptographic key was destroyed. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] result (`Integer`, 0 if operation failed, 1 if succeeded) - \[1\] alias of the key (`String`) - \[2\] owner of the key (`Integer`): - If the top bit is clear, this is the requesting process uid. - If the top bit is set, this identifies an [SELinux label](https://source.android.com/docs/security/features/keystore#selinux-policy). If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.

Constant Value: 210026 (0x0003346a) ### TAG_KEY_GENERATED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEY_GENERATED ``` Indicates that a cryptographic key was generated. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] result (`Integer`, 0 if operation failed, 1 if succeeded) - \[1\] alias of the key (`String`) - \[2\] owner of the key (`Integer`): - If the top bit is clear, this is the requesting process uid. - If the top bit is set, this identifies an [SELinux label](https://source.android.com/docs/security/features/keystore#selinux-policy). If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.

Constant Value: 210024 (0x00033468) ### TAG_KEY_IMPORT Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEY_IMPORT ``` Indicates that a cryptographic key was imported. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] result (`Integer`, 0 if operation failed, 1 if succeeded) - \[1\] alias of the key (`String`) - \[2\] owner of the key (`Integer`): - If the top bit is clear, this is the requesting process uid. - If the top bit is set, this identifies an [SELinux label](https://source.android.com/docs/security/features/keystore#selinux-policy). If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.

Constant Value: 210025 (0x00033469) ### TAG_KEY_INTEGRITY_VIOLATION Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_KEY_INTEGRITY_VIOLATION ``` Indicates a failed cryptographic key integrity check. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] alias of the key (`String`) - \[1\] owner of the key (`Integer`): - If the top bit is clear, this is the requesting process uid. - If the top bit is set, this identifies an [SELinux label](https://source.android.com/docs/security/features/keystore#selinux-policy). If security logging is enabled on organization-owned managed profile devices, only events happening inside the managed profile will be visible.

Constant Value: 210032 (0x00033470) ### TAG_LOGGING_STARTED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_LOGGING_STARTED ``` Indicates start-up of audit logging. There is no extra payload in the log event.
Constant Value: 210011 (0x0003345b) ### TAG_LOGGING_STOPPED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_LOGGING_STOPPED ``` Indicates shutdown of audit logging. There is no extra payload in the log event.
Constant Value: 210012 (0x0003345c) ### TAG_LOG_BUFFER_SIZE_CRITICAL Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_LOG_BUFFER_SIZE_CRITICAL ``` Indicates that the audit log buffer has reached 90% of its capacity. There is no extra payload in the log event.
Constant Value: 210015 (0x0003345f) ### TAG_MAX_PASSWORD_ATTEMPTS_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_MAX_PASSWORD_ATTEMPTS_SET ``` Indicates that an admin has set a maximum number of failed password attempts before wiping data. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] new maximum number of failed password attempts (`Integer`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setMaximumFailedPasswordsForWipe(android.content.ComponentName,%20int)` Constant Value: 210020 (0x00033464) ### TAG_MAX_SCREEN_LOCK_TIMEOUT_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_MAX_SCREEN_LOCK_TIMEOUT_SET ``` Indicates that an admin has set a maximum screen lock timeout. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] new screen lock timeout in milliseconds (`Long`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setMaximumTimeToLock(android.content.ComponentName,%20long)` Constant Value: 210019 (0x00033463) ### TAG_MEDIA_MOUNT Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_MEDIA_MOUNT ``` Indicates that removable media has been mounted on the device. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] mount point (`String`) - \[1\] volume label (`String`). Redacted to empty string on organization-owned managed profile devices.

Constant Value: 210013 (0x0003345d) ### TAG_MEDIA_UNMOUNT Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_MEDIA_UNMOUNT ``` Indicates that removable media was unmounted from the device. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] mount point (`String`) - \[1\] volume label (`String`). Redacted to empty string on organization-owned managed profile devices.

Constant Value: 210014 (0x0003345e) ### TAG_NFC_DISABLED Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_NFC_DISABLED ``` Indicates that NFC service is disabled. There is no extra payload in the log event.
Constant Value: 210046 (0x0003347e) ### TAG_NFC_ENABLED Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_NFC_ENABLED ``` Indicates that NFC service is enabled. There is no extra payload in the log event.
Constant Value: 210045 (0x0003347d) ### TAG_OS_SHUTDOWN Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_OS_SHUTDOWN ``` Indicates that the Android OS has shutdown. There is no extra payload in the log event.
Constant Value: 210010 (0x0003345a) ### TAG_OS_STARTUP Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_OS_STARTUP ``` Indicates that the Android OS has started. The log entry contains the following information about the startup time software integrity check encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Verified Boot state (`String`) - \[1\] dm-verity mode (`String`). Verified Boot state can be one of the following: - `green` indicates that there is a full chain of trust extending from the bootloader to verified partitions including the bootloader, boot partition, and all verified partitions. - `yellow` indicates that the boot partition has been verified using the embedded certificate and the signature is valid. - `orange` indicates that the device may be freely modified. Device integrity is left to the user to verify out-of-band. dm-verity mode can be one of the following: - `enforcing` indicates that the device will be restarted when corruption is detected. - `eio` indicates that an I/O error will be returned for an attempt to read corrupted data blocks. - `disabled` indicates that integrity check is disabled. For details see Verified Boot documentation.

Constant Value: 210009 (0x00033459) ### TAG_PACKAGE_INSTALLED Added in [API level 34](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PACKAGE_INSTALLED ``` Indicates that a package is installed. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Name of the package being installed (`String`) - \[1\] Package version code (`Long`) - \[2\] UserId of the user that installed this package (`Integer`)

Constant Value: 210041 (0x00033479) ### TAG_PACKAGE_UNINSTALLED Added in [API level 34](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PACKAGE_UNINSTALLED ``` Indicates that a package is uninstalled. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Name of the package being uninstalled (`String`) - \[1\] Package version code (`Long`) - \[2\] UserId of the user that uninstalled this package (`Integer`)

Constant Value: 210043 (0x0003347b) ### TAG_PACKAGE_UPDATED Added in [API level 34](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PACKAGE_UPDATED ``` Indicates that a package is updated. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Name of the package being updated (`String`) - \[1\] Package version code (`Long`) - \[2\] UserId of the user that updated this package (`Integer`)

Constant Value: 210042 (0x0003347a) ### TAG_PASSWORD_CHANGED Added in [API level 33](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PASSWORD_CHANGED ``` Indicates that a user has just changed their lockscreen password. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] complexity for the new password (`Integer`) - \[1\] target user ID (`Integer`) Password complexity levels are defined as in `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#getPasswordComplexity()`
Constant Value: 210036 (0x00033474) ### TAG_PASSWORD_COMPLEXITY_REQUIRED Added in [API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PASSWORD_COMPLEXITY_REQUIRED ``` Indicates that an admin has set a password complexity requirement, using the platform's pre-defined complexity levels. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] Password complexity (`Integer`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setRequiredPasswordComplexity(int)` Constant Value: 210035 (0x00033473) ### TAG_PASSWORD_COMPLEXITY_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PASSWORD_COMPLEXITY_SET ``` Indicates that an admin has set a requirement for password complexity. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] minimum password length (`Integer`) - \[4\] password quality constraint (`Integer`) - \[5\] minimum number of letters (`Integer`) - \[6\] minimum number of non-letters (`Integer`) - \[7\] minimum number of digits (`Integer`) - \[8\] minimum number of uppercase letters (`Integer`) - \[9\] minimum number of lowercase letters (`Integer`) - \[10\] minimum number of symbols (`Integer`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumLength(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordQuality(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumLetters(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumNonLetter(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumLowerCase(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumUpperCase(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumNumeric(android.content.ComponentName,%20int)` - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordMinimumSymbols(android.content.ComponentName,%20int)` Constant Value: 210017 (0x00033461) ### TAG_PASSWORD_EXPIRATION_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PASSWORD_EXPIRATION_SET ``` Indicates that an admin has set a password expiration timeout. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] new password expiration timeout in milliseconds (`Long`).

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordExpirationTimeout(android.content.ComponentName,%20long)` Constant Value: 210016 (0x00033460) ### TAG_PASSWORD_HISTORY_LENGTH_SET Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_PASSWORD_HISTORY_LENGTH_SET ``` Indicates that an admin has set a password history length. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] target user ID (`Integer`) - \[3\] new password history length value (`Integer`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPasswordHistoryLength(android.content.ComponentName,%20int)` Constant Value: 210018 (0x00033462) ### TAG_REMOTE_LOCK Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_REMOTE_LOCK ``` Indicates that an admin remotely locked the device or profile. The log entry contains the following information about the event encapsulated in an `https://developer.android.com/reference/java/lang/Object` array, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`), - \[1\] admin user ID (`Integer`). - \[2\] target user ID (`Integer`)

Constant Value: 210022 (0x00033466) ### TAG_SYNC_RECV_FILE Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_SYNC_RECV_FILE ``` Indicates that a file was pulled from the device via the adb daemon, for example via `adb pull`. The log entry contains a `String` payload containing the path of the pulled file on the device, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`.
Constant Value: 210003 (0x00033453) ### TAG_SYNC_SEND_FILE Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_SYNC_SEND_FILE ``` Indicates that a file was pushed to the device via the adb daemon, for example via `adb push`. The log entry contains a `String` payload containing the destination path of the pushed file, accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`.
Constant Value: 210004 (0x00033454) ### TAG_USER_RESTRICTION_ADDED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_USER_RESTRICTION_ADDED ``` Indicates that an admin has set a user restriction. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] user restriction (`String`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#addUserRestriction(android.content.ComponentName,%20java.lang.String)` Constant Value: 210027 (0x0003346b) ### TAG_USER_RESTRICTION_REMOVED Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_USER_RESTRICTION_REMOVED ``` Indicates that an admin has removed a user restriction. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] admin package name (`String`) - \[1\] admin user ID (`Integer`) - \[2\] user restriction (`String`)

**See also:** - `https://developer.android.com/reference/android/app/admin/DevicePolicyManager#clearUserRestriction(android.content.ComponentName,%20java.lang.String)` Constant Value: 210028 (0x0003346c) ### TAG_WIFI_CONNECTION Added in [API level 33](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_WIFI_CONNECTION ``` Indicates that an event occurred as the device attempted to connect to a managed WiFi network. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Last 2 octets of the network BSSID (`String`, in the form "xx:xx:xx:xx:AA:BB") - \[1\] Type of event that occurred (`String`). Event types are CONNECTED, DISCONNECTED, ASSOCIATING, ASSOCIATED, EAP_METHOD_SELECTED, EAP_FAILURE, SSID_TEMP_DISABLED, and OPEN_SSL_FAILURE. - \[2\] Optional human-readable failure reason, empty string if none (`String`)

Constant Value: 210037 (0x00033475) ### TAG_WIFI_DISCONNECTION Added in [API level 33](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_WIFI_DISCONNECTION ``` Indicates that the device disconnects from a managed WiFi network. The log entry contains the following information about the event, encapsulated in an `https://developer.android.com/reference/java/lang/Object` array and accessible via `https://developer.android.com/reference/android/app/admin/SecurityLog.SecurityEvent#getData()`: - \[0\] Last 2 octets of the network BSSID (`String`, in the form "xx:xx:xx:xx:AA:BB") - \[1\] Optional human-readable disconnection reason, empty string if none (`String`)

Constant Value: 210038 (0x00033476) ### TAG_WIPE_FAILURE Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final int TAG_WIPE_FAILURE ``` Indicates a failure to wipe device or user data. There is no extra payload in the log event.
Constant Value: 210023 (0x00033467) ## Public constructors ### SecurityLog ``` public SecurityLog () ```