Z-Wave Lock Opened in the middle of the night

[danny07]

I had something very strange happen last night and I can't figure out what could have caused it. At 3:00am, while we were all asleep, the Z-wave door lock between my mudroom and the garage suddenly unlocked on its own. I have Alexa connected to my ISY and it calls out some events such as garage doors and locks opening and closing (mainly because of my very young kids), so it woke my wife and I up at 3:00am with that message, which was pretty scary. Fortunately I have a camera in the garage so I was able to see that no one was or had been there to unlock it, and the alarm was armed and quiet so no doors or windows were opened to get to that door.

After that I was more awake than I wanted so I tried to check and see what could have happened. I have not programmed or changed anything related this or other locks in months, so I'm not sure where this came from. I checked the ISY programs and the only one that ran at 3:00am was the built in "Query All", but that runs everyday at that time, has never done this before, and should not be performing commands. I checked the ISY log and, other than seeing that the lock status changed to "unlocked" at 3:00am (and a couple of minutes later to "locked", when I manually locked it), I can't find anything. I also checked the error log which also seems to do something everyday at that time, but there was nothing different or weird about last night. I checked my network and I don't think anyone hacked into my system, but maybe I should check to see if I find a way to see a login log for the ISY, is that possible?

Does anyone have any thoughts for what could have happened or what could have caused this? Is there any other way or tool that I can use to find out what or who triggered my lock to unlock?

Thanks in advance!

[Mecheng70]

Did you see what alarm state it was in when is unlocked?

There are several codes that indicate if it was manually inside, manually outside or remotely unlocked.  

I can't remember them off the top of my head but maybe see what the logs say.  

 

 

IXA_AC-0 = Idle

IXA_AC-1 = Manual lock

IXA_AC-2 = Manual unlock

IXA_AC-3 = RF lock

IXA_AC-4 = RF unlock

IXA_AC-5 = Keypad lock

IXA_AC-6 = Keypad unlock

IXA_AC-7 = Manual not fully locked

IXA_AC-8 = RF not fully locked

IXA_AC-9 = Auto locked

IXA_AC-10 = Auto lock not fully locked

IXA_AC-11 = Lock jammed

IXA_AC-12 = All user codes deleted

IXA_AC-13 = Single user code deleted

IXA_AC-14 = User code added

IXA_AC-15 = User code not added (duplicate)

IXA_AC-16 = Keypad temporary disabled

IXA_AC-17 = Keypad busy

IXA_AC-18 = New program code entered

IXA_AC-19 = Manual code entry limit

IXA_AC-20 = Unlock by RF with invalid user code

IXA_AC-21 = Locked by RF with invalid user code

IXA_AC-22 = Window/door is open

IXA_AC-23 = Window/door is closed

IXA_AC-24 = Window/door handle is open

IXA_AC-25 = Window/door handle is closed

IXA_AC-32 = Messaging User Code entered via keypad

Edited February 27, 2021 by Mecheng70
Found codes

[Mecheng70]

Here is an example of manual unlock and lock from the event log from my.isy.io

ZW007_1          ST        Unlocked  2021/02/28 10:48:37  System    5
ZW007_306N001    ALARM     2         2021/02/28 10:48:37  System    5
ZW031_308        ALARM     8         2021/02/28 10:49:03  System    5
ZW031_155        ST        On        2021/02/28 10:49:03  System    5
ZW048_308        ALARM     8         2021/02/28 10:49:07  System    5
ZW048_155        ST        On        2021/02/28 10:49:07  System    5
ZW007_1          ST        Locked    2021/02/28 10:49:10  System    5
ZW007_306N001    ALARM     1         2021/02/28 10:49:10  System    5

 

[danny07]

Hi @Mecheng70,

Thanks for the information. I can't see a code on my log, I don't know if I'm doing something wrong or differently:

INSTEON Device          Control    Value          Time                                            User Log    Type

Mudroom Door-Lock   Status      Unlocked    Sat 2021/02/27 03:00:32 AM   System       Log

Mudroom Door-Lock   Status      Locked        Sat 2021/02/27 03:06:36 AM   System       Log

[Mecheng70]

@danny07 Which log are you looking in?  The column header says "INSTEON Device".

 

Do you have the portal module?  If not, attached is my events log from Admin console: Tools->Diagnostics-> Event Viewer

My devices start with ZWXXX_YYY - are you seeing those?

Edited February 28, 2021 by Mecheng70

[danny07]

Hi @Mecheng70,

Yes, sorry I did this from the Admin Console directly under Tools, and not Tools-Diagnostics. When I used the online portal I got the same that you showed on the first post.

I just checked the Tools->Diagnostics->Event Viewer and I can see the same you showed above. Unfortunately it doesn't go back to yesterday so I can't see more info from yesterday morning. 

[Mecheng70]

I just realized that I pushed you that direction.  Sorry.  I think that you are looking in the right place.  The web event log has the device IDs.  where you able to find the device in that?

[Mecheng70]

Do you have an alarm node for the zwave lock?

 

I have the main node called Front and the alarm node called Front Alarm.  It is the Front Alarm, or whatever you named it, that you want to look for in the log file.

 

Here is what it looks like in the excel file:

Edited February 28, 2021 by Mecheng70

[danny07]

@Mecheng70 I was able to find the device of the web log, but it says the same (just with the device ID instead of the name).

I don't have an alarm node for the device. I don't know if my device doesn't support it (it's a Z-Wave+) or if it's something I should have setup somehow and I didn't. Maybe this would help me if it happened again. How did you create this alarm node?

[Mecheng70]

Very interesting. Those nodes were created automatically when I added the Z-Wave device. I have the kwikset 910. Have had over seven of those over the past five years.

[Mecheng70]

In the admin console, if you click on the root of the device tree, you can sort all the devices by the name that the ISY gives it.  see if there is another node there that might have a strange name that maybe you put in a different folder somewhere.

I know I did that when I first got my ISY.

[danny07]

Weird, I also have 2 Kwikset locks and none of them have it. I wonder if it's a setting on the device and I never set it so it's not showing up.

I checked on the root of the device tree and I did see that my Front Door Lock also has a Low Battery Alarm and an Energy Meter. They are both clear, and the Energy Meter makes no sense to me so I'm wondering if these are remains from an older Z-Wave product that I had and removed before installing that lock.

[Mecheng70]

Maybe put a support ticket in, they may be able to help you with this. I have the latest 5.3 software as well as the latest Z-Wave board. I don't know if that matters..

[danny07]

That might be it, I don't have the new board so I'm still on 5.0.16C. I thought I'd read the newer firmware only took advantage of the extra capabilities of the new board, but I will check again.

Thanks for all your help!

[lilyoyo1]

1 hour ago, danny07 said:

That might be it, I don't have the new board so I'm still on 5.0.16C. I thought I'd read the newer firmware only took advantage of the extra capabilities of the new board, but I will check again.

Thanks for all your help!

To upgrade past 5.16, you'll need the new board. It doesn't work with the old board.

Unless all devices are zwave plus, you really don't get any advantage with the newer features unless there's a specific feature in the upgrade that you're looking for. 

[Mecheng70]

I could be mistaken, but I think these nodes have been around for a while now.