Deleting Audit Records - Cisco ISR 4000 series Configuration Manual

Cisco ISR 4000 Family Routers Administrator Guidance
Requirement
FPT_TUD_EXT.1: Trusted
update
FPT_TST_EXT.1: TSF
testing
FTA_SSL_EXT.1: TSF-
initiated session locking
FTA_SSL.3: TSF-initiated
termination
FTA_SSL.4: User-initiated
termination
FTA_TAB.1: Default TOE
access banners
FTP_ITC.1: Inter-TSF
trusted channel
FTP_TRP.1: Trusted path
5.1

Deleting Audit Records

The TOE provides the privileged Administrator the ability to delete audit records audit records
stored within the TOE.
This is done with the clear logging command.
TOE-common-criteria# clear logging
Clear logging buffer [confirm] <ENTER>
Management Action to
Log
Software updates
None
Specifying the inactivity
time period.
Specifying the inactivity
time period.
Logging out of TOE.
Configuring the banner
displayed prior to
authentication.
None
Connecting to the TOE
with SSH.
Sample Log
Jul 10 2013 11:04:09.179: %PARSER-5-
CFGLOG_LOGGEDCMD:
User:cisco logged command:upgrade
N/A
Feb 15 2013 13:12:25.055: %PARSER-5-
CFGLOG_LOGGEDCMD: User:cisco
logged command: exec-timeout 60
Feb 15 2013 13:12:25.055: %PARSER-5-
CFGLOG_LOGGEDCMD: User:cisco
logged command: exec-timeout 60
Feb 15 2013 13:12:25.055: %PARSER-5-
CFGLOG_LOGGEDCMD: User:cisco
logged command: exit
Feb 15 2013 13:12:25.055: %PARSER-5-
CFGLOG_LOGGEDCMD: User:cisco
logged command: banner login d This is a
banner d
N/A
Jan 17 05:05:49.460: %SEC_LOGIN-5-
LOGIN_SUCCESS: Login Success [user:
ranger] [Source: 21.0.0.3] [localport: 22]
at 00:05:49 EST Thu Jan 17 2013
Page 57 of 66