Cisco ASR 1000 Series Common Criteria Operational User Guidance And Preparative Procedures page 49

Requirement Auditable
Events
Failure to
FCS_SSHS_EX
establish an SSH
T.1
session
Additional Audit
Record Contents
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
1/3
0/1
3
Reason for failure.
Failure to establish a SSH Session.
IP address of remote host
Reason for failure.
GENERIC EXAMPLE: Jun 18 2012 11:19:06 UTC:
%SEC_LOGIN-4-LOGIN_FAILED: Login failed
[user: anonymous] [Source: 100.1.1.5] [localport: 22]
[Reason: Login Authentication Failed] at 11:19:06
UTC Mon Jun 18 2012
Establishment of a SSH session
IP address of remote host
Jun 18 2012 11:31:35 UTC: %SEC_LOGIN-5-
LOGIN_SUCCESS: Login Success [user: ranger]
Sample Record
11: No
04: tic 132: *Jan 30 2013 05:20:16: %SYS-5-CONFIG_
43 e Configured from console by console
11: De
09: bu 136: *Jan 30 10:54:46.421 IST: crypto_engine
13 g IPsec SA
11: De
09: bu 135: *Jan 30 10:54:46.421 IST: crypto engine:
13 g IPsec SA :12
11: No 171: *Jan 30 2013 05:27:31: %PARSER-5-
11: tic CFGLOG_LOGGEDCMD: User:console logged
58 e command:no crypto map
11: No 172: *Jan 30 2013 05:27:42: %PARSER-5-
12: tic CFGLOG_LOGGEDCMD: User:console logged
08 e command:crypto map cc
11: No 171: *Jan 30 2013 05:27:31: %PARSER-5-
11: tic CFGLOG_LOGGEDCMD: User:console logged
58 e command:no crypto map
11: No 172: *Jan 30 2013 05:27:42: %PARSER-5-
12: tic CFGLOG_LOGGEDCMD: User:console logged
08 e command:crypto map cc
11: No 171: *Jan 30 2013 05:27:31: %PARSER-5-
11: tic CFGLOG_LOGGEDCMD: User:console logged
58 e command:no crypto map
11: No 172: *Jan 30 2013 05:27:42: %PARSER-5-
12: tic CFGLOG_LOGGEDCMD: User:console logged
08 e command:crypto map cc
11: No 171: *Jan 30 2013 05:27:31: %PARSER-5-
11: tic CFGLOG_LOGGEDCMD: User:console logged
58 e command:no crypto map
Page 49 of 72