This guide documents the classic version of the AWS Wickr administration console, released before March 13, 2025. For documentation on the new AWS Wickr administration console, see [ Administration Guide](https://docs.aws.amazon.com/wickr/latest/adminguide/what-is-wickr.html).

# Data retention metrics and events for your Wickr network
<a name="metrics-events"></a>

Following are the Amazon CloudWatch (CloudWatch) metrics and Amazon Simple Notification Service (Amazon SNS) events that are currently supported by the 5.116 version of the AWS Wickr data retention bot.

**Topics**
+ [CloudWatch metrics for your Wickr network](cloudwatch-metrics.md)
+ [Amazon SNS events for your Wickr network](sns-events.md)

# CloudWatch metrics for your Wickr network
<a name="cloudwatch-metrics"></a>

Metrics are generated by the bot in 1 minute intervals and transmitted to the CloudWatch service associated with the account the data retention bot Docker image is running on.

Following are the existing metrics supported by the data retention bot.


| Metric | Description | 
| --- | --- | 
|  Messages\$1Rx  |  Messages received.  | 
|  Messages\$1Rx\$1Failed  |  Failures to process received messages.  | 
|  Messages\$1Saved  |  Messages saved to the received messages file.  | 
|  Messages\$1Saved\$1Failed  |  Failures to save messages to the received messages file.  | 
|  Files\$1Saved  |  Files received.  | 
|  Files\$1Saved\$1Bytes  |  Number of bytes for files received.  | 
|  Files\$1Saved\$1Failed  |  Failures to save files.  | 
|  Logins  |  Logins (normally this will be 1 for each interval).  | 
|  Login\$1Failures  |  Failures to login (normally this will be 1 for each interval).  | 
|  S3\$1Post\$1Errors  |  Errors posting message files and files to Amazon S3 bucket.  | 
|  Watchdog\$1Failures  |  Watchdog failures.  | 
|  Watchdog\$1Warnings  |  Watchdog warnings.  | 

Metrics are generated to be consumed by CloudWatch. The namespace used for bots is `WickrIO`. Each metric has an array of dimensions. Following is the list of dimensions that are posted with the above metrics.


| Dimension | Value | 
| --- | --- | 
|  Id  |  The bot's username.  | 
|  Device  |  Description of specific bot device or instance. Useful if you are running multiple bot devices or instances.  | 
|  Product  |  The product for the bot. Can be `WickrPro_` or `WickrEnterprise_` with `Alpha`, `Beta`, or `Production` appended.  | 
|  BotType  |  The bot type. Labeled as **Compliance** for the compliance bots.  | 
|  Network  |  The ID of the associated network.  | 

# Amazon SNS events for your Wickr network
<a name="sns-events"></a>

The following events are posted to the Amazon SNS topic defined by the Amazon Resource Name (ARN) value identified using the `WICKRIO_SNS_TOPIC_ARN` environment variable or the `sns_topic_arn` Secrets Manager secret value. For more information, see [Environment variables to configure data retention bot in AWS Wickr](data-retention-bot-env-variables.md) and [Secrets Manager values for AWS Wickr](data-retention-aws-secret-values.md).

Events generated by the data retention bot are sent as JSON strings. The following values are included in the events as of the 5.116 version of the data retention bot.


| Name | Value | 
| --- | --- | 
|  complianceBot  |  The username of the data retention bot.  | 
|  dataTime  |  The date and time when the event occurred.  | 
|  device  |  A description of the specific bot device or instance. Useful if you are running multiple bot instances.  | 
|  dockerImage  |  The Docker image associated with the bot.  | 
|  dockerTag  |  The tag or version of the Docker image.  | 
|  message  |  The event message. For more information see [Critical events](#sns-critical-events) and [Normal events](#sns-normal-events).  | 
|  notificationType  |  This value will be `Bot Event`.  | 
|  severity  |  The severity of the event. Can be `normal` or `critical`.  | 

You must subscribe to the Amazon SNS topic so that you can receive the events. If you subscribe using an email address, an email will be sent to you containing information similar to the following example.

```
{
"complianceBot": "compliance_1234567890_bot",
 "dateTime": "2022-10-12T13:05:39",
 "device": "Desktop 1234567890ab",
 "dockerImage": "wickr/bot-compliance-cloud",
 "dockerTag": "5.116.13.01",
 "message": "Logged in",
 "notificationType": "Bot Event",
 "severity": "normal"
}
```

## Critical events
<a name="sns-critical-events"></a>

These events will cause the bot to stop or restart. The number of restarts is limited to avoid causing other issues.

**Login failures**

Following are the possible events that can be generated when the bot fails to login. Each message will indicate the reason for the login failure.


| Event type | Event message | 
| --- | --- | 
|  failedlogin  |  Bad credentials. Check the password.  | 
|  failedlogin  |  User not found.  | 
|  failedlogin  |  Account or device is suspended.  | 
|  provisioning  |  User exited the command.  | 
|  provisioning  |  Bad password for the `config.wickr` file.  | 
|  provisioning  |  Cannot read the `config.wickr` file.  | 
|  failedlogin  |  Logins all failed.  | 
|  failedlogin  |  New user but database already exists.  | 

**More critical events**


| Event type | Event messages | 
| --- | --- | 
|  Suspended Account  |  WickrIOClientMain::slotAdminUserSuspend: code(%1): reason: %2“  | 
|  BotDevice Suspended  |  Device is suspended\$1  | 
|  WatchDog  |  The SwitchBoard system is down for more than <*N*> minutes  | 
|  S3 Failures  |  Failed to put file <*file-name*≫ on S3 bucket. Error: <*AWS-error*>  | 
|  Fallback Key  |  SERVER SUBMIITED FALLBACK KEY: Is not a recognized client active fallback key. Please submit logs to desktop engineering.  | 

## Normal events
<a name="sns-normal-events"></a>

Following are the events that warn you about normal operating occurrences. Too many occurrences of these types of events within a specific time period may be cause for concern.

**Device added to account**

This event is generated when a new device is added to the data retention bot account. Under some circumstances, this can be an important indication that someone has created an instance of the data retention bot. Following is the message for this event.

```
A device has been added to this account!
```

**Bot logged in**

This event is generated when the bot has successfully logged in. Following is the message for this event.

```
Logged in
```

**Shutting down**

This event is generated when the bot is shutting down. If the user did not explicitly initiate this, it could be an indication of a problem. Following is the message for this event.

```
Shutting down
```

**Updates available**

This event is generated when the data retention bot is started and it identifies that there is a newer version of the associated Docker image available. This event is generated when the bot starts, and on a daily basis. This event includes the `versions` array field which identifies the new versions that are available. Following is an example of what this event looks like.

```
{
  "complianceBot": "compliance_1234567890_bot",
  "dateTime": "2022-10-12T13:05:55",
  "device": "Desktop 1234567890ab",
  "dockerImage": "wickr/bot-compliance-cloud",
  "dockerTag": "5.116.13.01",
  "message": "There are updates available",
  "notificationType": "Bot Event",
  "severity": "normal",
  "versions": [
    "5.116.10.01"
  ]
}
```