> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/security/exporting-audit-logs/audit-trail-codes-portal-classic.md).

# Audit trail codes Portal (classic)

{% hint style="warning" %}
The audit trail codes on this page apply to Portal, Nexthink Experience.

Refer to the [Audit trail codes Infinity ](/platform/security/exporting-audit-logs/audit-trail-codes.md)documentation for audit trail codes that apply to Nexthink Infinity.

Refer to the [Exporting audit logs](/platform/security/exporting-audit-logs.md) to learn how to query audit trail codes.
{% endhint %}

| Code  | Description                                                                                 |
| ----- | ------------------------------------------------------------------------------------------- |
| 20001 | <p>Portal is starting</p><p><code>\[Portal</code></p>                                       |
| 20002 | <p>Portal is up and running</p><p><code>\[Portal</code></p>                                 |
| 20004 | <p>Portal is stopped</p><p><code>\[Portal</code></p>                                        |
| 20101 | <p>User logged in</p><p><code>\[Portal</code></p>                                           |
| 20102 | <p>User logged out</p><p><code>\[Portal</code></p>                                          |
| 20103 | <p>User login failed</p><p><code>\[Portal</code></p>                                        |
| 20104 | <p>User locked</p><p><code>\[Portal</code></p>                                              |
| 20201 | <p>User created</p><p><code>\[Portal</code></p>                                             |
| 20202 | <p>User removed</p><p><code>\[Portal</code></p>                                             |
| 20203 | <p>User updated</p><p><code>\[Portal</code></p>                                             |
| 20204 | <p>User profile updated</p><p><code>\[Portal</code></p>                                     |
| 20205 | <p>User domain ownership updated</p><p><code>\[Portal</code></p>                            |
| 20206 | <p>Role added</p><p><code>\[Portal</code></p>                                               |
| 20207 | <p>Role updated</p><p><code>\[Portal</code></p>                                             |
| 20208 | <p>Role removed</p><p><code>\[Portal</code></p>                                             |
| 20209 | <p>Profile added (with roles)</p><p><code>\[Portal</code></p>                               |
| 20210 | <p>Profile updated (with roles)</p><p><code>\[Portal</code></p>                             |
| 20211 | <p>Profile removed</p><p><code>\[Portal</code></p>                                          |
| 20501 | <p>Hierarchy added</p><p><code>\[Portal</code></p>                                          |
| 20502 | <p>Hierarchy removed</p><p><code>\[Portal</code></p>                                        |
| 20503 | <p>Hierarchy updated</p><p><code>\[Portal</code></p>                                        |
| 20504 | <p>Definition of entities updated</p><p><code>\[Portal</code></p>                           |
| 20505 | <p>Collector assignment updated</p><p><code>\[Portal</code></p>                             |
| 20701 | <p>Engine added</p><p><code>\[Portal</code></p>                                             |
| 20702 | <p>Engine removed</p><p><code>\[Portal</code></p>                                           |
| 20703 | <p>Engine connected</p><p><code>\[Portal</code></p>                                         |
| 20704 | <p>Engine disconnected</p><p><code>\[Portal</code></p>                                      |
| 20801 | <p>Finder user logged in</p><p><code>\[Portal</code></p>                                    |
| 20803 | <p>Finder user login failed</p><p><code>\[Portal</code></p>                                 |
| 20804 | <p>Library pack import request (only issued for big packs)</p><p><code>\[Portal</code></p>  |
| 20901 | <p>Remote action updated</p><p><code>\[Portal</code></p>                                    |
| 20902 | <p>Remote action created</p><p><code>\[Portal</code></p>                                    |
| 20903 | <p>Remote action deleted</p><p><code>\[Portal</code></p>                                    |
| 20911 | <p>Metric updated</p><p><code>\[Portal</code></p>                                           |
| 20912 | <p>Metric created</p><p><code>\[Portal</code></p>                                           |
| 20913 | <p>Metric deleted</p><p><code>\[Portal</code></p>                                           |
| 20921 | <p>Service updated</p><p><code>\[Portal</code></p>                                          |
| 20922 | <p>Service created</p><p><code>\[Portal</code></p>                                          |
| 20923 | <p>Service deleted</p><p><code>\[Portal</code></p>                                          |
| 20931 | <p>Campaign updated</p><p><code>\[Portal</code></p>                                         |
| 20932 | <p>Campaign created</p><p><code>\[Portal</code></p>                                         |
| 20933 | <p>Campaign deleted</p><p><code>\[Portal</code></p>                                         |
| 20941 | <p>Category updated</p><p><code>\[Portal</code></p>                                         |
| 20942 | <p>Category created</p><p><code>\[Portal</code></p>                                         |
| 20943 | <p>Category deleted</p><p><code>\[Portal</code></p>                                         |
| 21001 | <p>Manual execution of a remote action through the Finder</p><p><code>\[Portal</code></p>   |
| 21002 | <p>External execution of a remote action through the API</p><p><code>\[Portal</code></p>    |
| 21003 | <p>External execution of a remote action through the API v2</p><p><code>\[Portal</code></p> |
| 21101 | <p>Metric compute triggered from the Finder</p><p><code>\[Portal</code></p>                 |
| 21102 | <p>Metric clear history triggered by query</p><p><code>\[Portal</code></p>                  |
| 21103 | <p>Metric clear triggered from the Finder</p><p><code>\[Portal</code></p>                   |
| 21104 | <p>Metric compute triggered by query</p><p><code>\[Portal</code></p>                        |
| 21201 | <p>Module published</p><p><code>\[Portal</code></p>                                         |
| 21202 | <p>Module deleted</p><p><code>\[Portal</code></p>                                           |
| 21203 | <p>Module replaced</p><p><code>\[Portal</code></p>                                          |
| 21501 | <p>Dashboard deleted</p><p><code>\[Portal</code></p>                                        |
| 21301 | <p>Software metering metric updated</p><p><code>\[Portal</code></p>                         |
| 21302 | <p>Software metering metric deleted</p><p><code>\[Portal</code></p>                         |
| 21303 | <p>Software metering metric enabled</p><p><code>\[Portal</code></p>                         |
| 21304 | <p>Software metering metric disabled</p><p><code>\[Portal</code></p>                        |
| 21401 | <p>Software metering module updated</p><p><code>\[Portal</code></p>                         |
| 21402 | <p>Software metering module created</p><p><code>\[Portal</code></p>                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/security/exporting-audit-logs/audit-trail-codes-portal-classic.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.