Siemens RUGGEDCOM ROX II User Manual page 61

RUGGEDCOM ROX II
CLI User Guide
Section 1.7.2
Syslog Event Types
Two types of syslog events are defined.
Event
Alarm
Events of either type are stored locally on the device and transmitted automatically to the syslog server when they
occur.
Section 1.7.3
Logged Security Events
The following are security-related event messages that may be generated by RUGGEDCOM ROX II.
Category
SE_LOCAL_SUCCESSFUL_LOGON
SE_LOCAL_UNSUCCESSFUL_LOGON (Invalid
Username)
SE_LOCAL_UNSUCCESSFUL_LOGON (Invalid
Password)
SE_NETWORK_SUCCESSFUL_LOGON
SE_NETWORK_SUCCESSFUL_LOGON (Netconf)
Syslog Event Types
Event Type
audit user: {Username}/
{User ID} assigned to
groups: {User Group
Name}
audit user:{Username}/0
no such local user
login failed, reason='No
such local user',
user ipaddr='{User IP
Address}'
audit user:
{Username}/0 Provided
Invalid Password
login failed,
reason='Invalid
Password', user
ipaddr='{User IP
Address}'
audit user: {Username}/
{User ID} assigned to
groups: {User Group
Name}
username:{Username}
usid:{User ID} started
{Context} session from
ip:{IP Address} source-
port:{Port} through
{Protocol} protocol
netconf id={Netconf ID}
new ssh session for user
"{Username}" from {IP
Address}
Events are authorized activities that can be expected to occur during
routine use.
Alarms are activities that may indicate unauthorized activity.
Event Message Facility
LOG_AUTH
LOG_DAEMON
LOG_AUTHPRIV
LOG_DAEMON
LOG_AUTHPRIV
LOG_AUTH
LOG_AUTH
LOG_DAEMON
Introduction
Description
Event
Severity
Type
Notice Event
Info Alarm
Notice Alarm
Info Alarm
Notice Alarm
Notice Event
Notice Event
Info Event
Chapter 1
Log
Auth.log
Auth.log
Auth.log
Auth.log
Auth.log
Auth.log
auth.log
Auth.log
15