This guide documents the new AWS Wickr administration console, released on March 13, 2025. For documentation on the classic version of the AWS Wickr administration console, see [Classic Administration Guide](https://docs.aws.amazon.com/wickr/latest/adminguide-classic/what-is-wickr.html).

# Amazon SNS events for your Wickr network
<a name="sns-events"></a>

The following events are posted to the Amazon SNS topic defined by the Amazon Resource Name (ARN) value identified using the `WICKRIO_SNS_TOPIC_ARN` environment variable or the `sns_topic_arn` Secrets Manager secret value. For more information, see [Environment variables to configure data retention bot in AWS Wickr](data-retention-bot-env-variables.md) and [Secrets Manager values for AWS Wickr](data-retention-aws-secret-values.md).

Events generated by the data retention bot are sent as JSON strings. The following values are included in the events as of the 5.116 version of the data retention bot.


| Name | Value | 
| --- | --- | 
|  complianceBot  |  The username of the data retention bot.  | 
|  dataTime  |  The date and time when the event occurred.  | 
|  device  |  A description of the specific bot device or instance. Useful if you are running multiple bot instances.  | 
|  dockerImage  |  The Docker image associated with the bot.  | 
|  dockerTag  |  The tag or version of the Docker image.  | 
|  message  |  The event message. For more information see [Critical events](#sns-critical-events) and [Normal events](#sns-normal-events).  | 
|  notificationType  |  This value will be `Bot Event`.  | 
|  severity  |  The severity of the event. Can be `normal` or `critical`.  | 

You must subscribe to the Amazon SNS topic so that you can receive the events. If you subscribe using an email address, an email will be sent to you containing information similar to the following example.

```
{
"complianceBot": "compliance_1234567890_bot",
 "dateTime": "2022-10-12T13:05:39",
 "device": "Desktop 1234567890ab",
 "dockerImage": "wickr/bot-compliance-cloud",
 "dockerTag": "5.116.13.01",
 "message": "Logged in",
 "notificationType": "Bot Event",
 "severity": "normal"
}
```

## Critical events
<a name="sns-critical-events"></a>

These events will cause the bot to stop or restart. The number of restarts is limited to avoid causing other issues.

**Login failures**

Following are the possible events that can be generated when the bot fails to login. Each message will indicate the reason for the login failure.


| Event type | Event message | 
| --- | --- | 
|  failedlogin  |  Bad credentials. Check the password.  | 
|  failedlogin  |  User not found.  | 
|  failedlogin  |  Account or device is suspended.  | 
|  provisioning  |  User exited the command.  | 
|  provisioning  |  Bad password for the `config.wickr` file.  | 
|  provisioning  |  Cannot read the `config.wickr` file.  | 
|  failedlogin  |  Logins all failed.  | 
|  failedlogin  |  New user but database already exists.  | 

**More critical events**


| Event type | Event messages | 
| --- | --- | 
|  Suspended Account  |  WickrIOClientMain::slotAdminUserSuspend: code(%1): reason: %2“  | 
|  BotDevice Suspended  |  Device is suspended\$1  | 
|  WatchDog  |  The SwitchBoard system is down for more than <*N*> minutes  | 
|  S3 Failures  |  Failed to put file <*file-name*≫ on S3 bucket. Error: <*AWS-error*>  | 
|  Fallback Key  |  SERVER SUBMIITED FALLBACK KEY: Is not a recognized client active fallback key. Please submit logs to desktop engineering.  | 

## Normal events
<a name="sns-normal-events"></a>

Following are the events that warn you about normal operating occurrences. Too many occurrences of these types of events within a specific time period may be cause for concern.

**Device added to account**

This event is generated when a new device is added to the data retention bot account. Under some circumstances, this can be an important indication that someone has created an instance of the data retention bot. Following is the message for this event.

```
A device has been added to this account!
```

**Bot logged in**

This event is generated when the bot has successfully logged in. Following is the message for this event.

```
Logged in
```

**Shutting down**

This event is generated when the bot is shutting down. If the user did not explicitly initiate this, it could be an indication of a problem. Following is the message for this event.

```
Shutting down
```

**Updates available**

This event is generated when the data retention bot is started and it identifies that there is a newer version of the associated Docker image available. This event is generated when the bot starts, and on a daily basis. This event includes the `versions` array field which identifies the new versions that are available. Following is an example of what this event looks like.

```
{
  "complianceBot": "compliance_1234567890_bot",
  "dateTime": "2022-10-12T13:05:55",
  "device": "Desktop 1234567890ab",
  "dockerImage": "wickr/bot-compliance-cloud",
  "dockerTag": "5.116.13.01",
  "message": "There are updates available",
  "notificationType": "Bot Event",
  "severity": "normal",
  "versions": [
    "5.116.10.01"
  ]
}
```