Cisco ISR 4000 series Configuration Manual page 51

Cisco ISR 4000 Family Routers Administrator Guidance
Requirement Auditable Events
FPT_STM.1 Changes to the
time.
FPT_RPL.1 Detected
attempt
FPT_TUD_EXT.1 Initiation
update. result of
the update attempt
(success
failure)
FPT_TST_EXT.1 Indication
TSF self-test was
completed.
FPT_TST_EXT.2 Failure of self-test
Additional
Audit Record
Contents
The old and
new values for
the time.
Origin of the
attempt (e.g.,
IP address).
replay None.
of No additional
information.
or
that Any additional
information
generated by
the tests
beyond
"success" or
"failure".
Reason for
failure
(including
identifier of
Sample Record
Local Clock Update: CLOCKUPDATE:
System clock has been updated from
06:11:37 EDT Mon Dec 20 2010 to
06:10:00 EDT Tue Dec 20 2011,
configured from console by user on
console.
One audit record for NTP changing the
time:
Jun 20 09:52:39.622:
Core(NOTICE): Clock is synchronized.
*Jul 7 18:43:14.595:
MKPDU_VALIDATE_FAILURE:
(Gi0/0/1 : 11) Validation of a MKPDU
failed for RxSCI 6412.25a1.a409/0009,
AuditSessionID
12340000000000000000000000000000
00000000000000000000000000000000
Use of the "upgrade" command.
*Jul 10 11:04:09.179: %PARSER-5-
CFGLOG_LOGGEDCMD:
User:cisco logged command:upgrade
*Jul 10 11:04:09.179: %PARSER-5-
CFGLOG_LOGGEDCMD:
User:cisco logged command:copy tftp
....
*Jul 10 11:04:09.179: %PARSER-5-
CFGLOG_LOGGEDCMD:
User:cisco logged command:reload
Jan 23 2013 06:53:24.570: %CRYPTO-
6-SELF_TEST_RESULT: Self test info:
(Self test activated by user: admin)
Jan 23 2013 06:53:24.670: %CRYPTO-
6-SELF_TEST_RESULT: Self test info:
(Software checksum
passed)
Cause: c3m_set_fips_mode, Fatal Fault,
FIPS POST Failure requested by: Process
NTP
%MKA-3-
, CKN
...
Page 51 of 66