---
type: "codesystem"
title: "Audit Event Severity"
codesystem: "audit-event-severity"
---
# Audit Event Severity

- **Official URL**: http://hl7.org/fhir/audit-event-severity
- **Version**: 6.0.0
- **Status**: active
- **Name**: AuditEventSeverity
- **Title**: Audit Event Severity
- **Publisher**: HL7 International / Security
- **Description**: The severity of the audit entry. These codes are derived from the SysLog header, PRI. http://tools.ietf.org/html/rfc5424#appendix-A.3
- **Case Sensitive**: true
- **Content**: complete

## Concepts

| Code | Display | Definition |
| --- | --- | --- |
| emergency | Emergency | System is unusable. e.g., This level SHOULD only be reported by infrastructure and SHOULD NOT be used by applications. |
| alert | Alert | Notification SHOULD be sent to trigger action be taken. e.g., Loss of the primary network connection needing attention. |
| critical | Critical | Critical conditions. e.g., A failure in the system's primary application that will reset automatically. |
| error | Error | Error conditions. e.g., An application has exceeded its file storage limit and attempts to write are failing. |
| warning | Warning | Warning conditions. May indicate that an error will occur if action is not taken. e.g., A non-root file system has only 2GB remaining. |
| notice | Notice | Notice messages. Normal but significant condition. Events that are unusual, but not error conditions. |
| informational | Informational | Normal operational messages that require no action. e.g., An application has started, paused, or ended successfully. |
| debug | Debug | Debug-level messages. Information useful to developers for debugging the application. |

## CodeSystem XML



```xml
<?xml version="1.0" encoding="UTF-8"?>

<CodeSystem xmlns="http://hl7.org/fhir">
  <id value="audit-event-severity"/>
  <meta>
    <lastUpdated value="2022-06-06T10:01:24.148+11:00"/>
  </meta>
  <extension url="http://hl7.org/fhir/StructureDefinition/structuredefinition-wg">
    <valueCode value="sec"/>
  </extension>
  <extension url="http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status">
    <valueCode value="normative"/>
  </extension>
  <extension url="http://hl7.org/fhir/StructureDefinition/structuredefinition-fmm">
    <valueInteger value="6"/>
  </extension>
  <url value="http://hl7.org/fhir/audit-event-severity"/>
  <identifier>
    <system value="urn:ietf:rfc:3986"/>
    <value value="urn:oid:2.16.840.1.113883.4.642.4.1894"/>
  </identifier>
  <version value="6.0.0"/>
  <name value="AuditEventSeverity"/>
  <title value="Audit Event Severity"/>
  <status value="active"/>
  <experimental value="false"/>
  <date value="2025-11-01"/>
  <publisher value="HL7 International / Security"/>
  <contact>
    <telecom>
      <system value="url"/>
      <value value="http://www.hl7.org/Special/committees/secure"/>
    </telecom>
    <telecom>
      <system value="email"/>
      <value value="fhir@lists.hl7.org"/>
    </telecom>
  </contact>
  <description value="The severity of the audit entry. These codes are derived from the SysLog header, PRI. http://tools.ietf.org/html/rfc5424#appendix-A.3"/>
  <caseSensitive value="true"/>
  <valueSet value="http://hl7.org/fhir/ValueSet/audit-event-severity"/>
  <content value="complete"/>
  <concept>
    <code value="emergency"/>
    <display value="Emergency"/>
    <definition value="System is unusable. e.g., This level SHOULD only be reported by infrastructure and SHOULD NOT be used by applications."/>
  </concept>
  <concept>
    <code value="alert"/>
    <display value="Alert"/>
    <definition value="Notification SHOULD be sent to trigger action be taken. e.g., Loss of the primary network connection needing attention."/>
  </concept>
  <concept>
    <code value="critical"/>
    <display value="Critical"/>
    <definition value="Critical conditions. e.g., A failure in the system's primary application that will reset automatically."/>
  </concept>
  <concept>
    <code value="error"/>
    <display value="Error"/>
    <definition value="Error conditions. e.g., An application has exceeded its file storage limit and attempts to write are failing. "/>
  </concept>
  <concept>
    <code value="warning"/>
    <display value="Warning"/>
    <definition value="Warning conditions. May indicate that an error will occur if action is not taken. e.g., A non-root file system has only 2GB remaining."/>
  </concept>
  <concept>
    <code value="notice"/>
    <display value="Notice"/>
    <definition value="Notice messages. Normal but significant condition. Events that are unusual, but not error conditions."/>
  </concept>
  <concept>
    <code value="informational"/>
    <display value="Informational"/>
    <definition value="Normal operational messages that require no action. e.g., An application has started, paused, or ended successfully."/>
  </concept>
  <concept>
    <code value="debug"/>
    <display value="Debug"/>
    <definition value="Debug-level messages. Information useful to developers for debugging the application."/>
  </concept>
</CodeSystem>
```