Have a look in the History Agent and see what it says there. Turn off info and only look at the other 2 event types. I have found the following (again, my case is slightly different to yours):
- mine shows up at seemingly random times.
- mine shows up in the History Agent (in Composer) as Security/unused/3150/Arm failed or something like that.
- today, I realized that the 3150 (which is sometimes 3148 or 3149) is the device ID of partition 4 (or 2 or 3) in my security driver (even though I actually only have 1 active partition). For some reason, the 7 unused partitions are (occasionally doing their own thing).
- if I look on my T3 (any of them) these all appear as “arm failed” in history.
- if I look on the C4 app on my iPad, these don’t appear... clearly the iPad is more clever and only looks at messages pertaining to a genuine partition. For genuine partition history items, the “Unused” in the History Agent (within Composer) changes to “1 Skynet Place” where “1 Skynet Place” is my address (not really) and the name of my Partition in the Driver.
Very weird!