Cisco Firepower 4110 Preparative Procedures & Operational User Manual page 22

Cisco Preparative Procedures & Operational User Guide
SFR Auditable
Event
the time.
FTA_SSL_EXT.1 Any attempts
at unlocking
of an
interactive
session.
FTA_SSL.3 The
termination
of a remote
session by the
session
locking
mechanism.
FTA_SSL.4 The
termination
of an
interactive
session.
FTP_ITC.1 Initiation of
the trusted
channel.
Termination
of the trusted
channel.
Failure of the
trusted
channel
functions.
© 2016 Cisco Systems, Inc. All rights reserved.
Actual Audited Event
PWD=/bootflash/sysdebug/coremgmt/sam_dump ; USER=root ;
COMMAND=/bin/date -s Sat Aug 15 12:30:00 2020 – sudo
%AUTHPRIV-5-SYSTEM_MSG: USERNAME : TTY=ttyS0 ;
PWD=/bootflash/sysdebug/coremgmt/sam_dump ; USER=root ;
COMMAND=/isan/bin/check_ntp_server.sh - sudo
switch A: cmd: set clock oct 31 2016 6 20 0 from 2016-11-01T01:17:30.679,
logged in from console on term /dev/ttyS0: Local mgmt command executed
%FPRM-6-AUDIT: [session][internal][deletion][internal][1313572][sys/user-
ext/user- USERNAME /term-ttyS0_1_7995][sys/user-ext/user-admin/term-
ttyS0_1_7995][] Fabric A: system terminated session id ttyS0_1_7995 of user
USERNAME due to idle timeout
%FPRM-6-AUDIT: [session][internal][deletion][internal][1204232][sys/user-
ext/remoteuser- USERNAME /term-web_16073_A][sys/user-ext/remoteuser-
USERNAME /term-web_16073_A][] Web A: system terminated Web session
id web_16073_A of user USERNAME due to idle timeout
%FPRM-6-AUDIT: [session][internal][deletion][internal][1204385][sys/user-
ext/user- USERNAME /term-pts_0_1_12413][sys/user-ext/user- USERNAME
/term-pts_0_1_12413][] Fabric A: system terminated session id
pts_0_1_12413 of user USERNAME due to idle timeout
%FPRM-6-AUDIT: [session][internal][deletion][internal][1205445][sys/user-
ext/user- USERNAME /term-ttys0_1_3038][sys/user-ext/user- USERNAME
/term-ttys0_1_3038][] Fabric A: user USERNAME terminated session id
ttyS0_1_3038
IPSec
%AUTHPRIV-6-SYSTEM_MSG: 05[IKE] IKE_SA test2[3] established
between IP_ADDRESS [C=US, ST=CA, O=cisco, OU=STBU,
CN=D_NAME]...IP_ADDRESS [C=US, O=Luo, CN=D_NAME] - charon-
custom
2017 Jan 31 10:10:04 mio4-A %AUTHPRIV-6-SYSTEM_MSG: 15[IKE]
sending DELETE for ESP CHILD_SA with SPI cd365fb3 - char on-custom
%AUTHPRIV-6-SYSTEM_MSG: 15[IKE] failed to establish CHILD_SA,
keeping IKE_SA - charon-custom
TLS
%USER-6-SYSTEM_MSG: [ssl:info] [pid 8926:tid 1823603600] [client
IP_ADDRESS:60782] AH01964: Connection to child 124 established (server