Audit Trail - ABB REX610 Operation Manual

Section 3
REX610 overview
3.3.1
22
required. The highest role for the username is automatically
selected by the protection relay. Performing the Restore Factory
settings operation in IED Users in PCM600 restores user accounts
to the factory user accounts.

Audit trail

The protection relay offers a large set of event-logging functions. Critical system
and protection relay security-related events are logged to a separate nonvolatile
audit trail for the administrator.
Audit trail is a chronological record of system activities that allows the
reconstruction and examination of the sequence of system and security-related
events and changes in the protection relay. Both audit trail events and process
related events can be examined and analyzed in a consistent method with the help
of Event List in LHMI and Event Viewer in PCM600.
The protection relay stores 2048 audit trail events to the nonvolatile audit trail.
Additionally, 1024 process events are stored in a nonvolatile event list. Both the
audit trail and event list work according to the FIFO principle. Nonvolatile memory
is based on a memory type which does not need battery backup nor regular
component change to maintain the memory storage.
Audit trail events related to user authorization (login, logout) are defined according
to the selected set of requirements from IEEE 1686. The logging is based on
predefined user names or user categories. The user audit trail events are accessible
from Event Viewer in PCM600.
Table 14: Audit trail events
Event ID
1110
1210
1130
13200
1380
1460
1520
1610
2210
2220
5270
6110
Table continues on next page
Audit trail event
Login
Logout
Login failure
Configuration transfer
Parameter change
Parameter change fail
Software update
Software update fail
Password change
Password change fail
System startup
Test on
2NGA000823 A
Description
Successful login from LHMI and PCM600
Successful logout from LHMI, PCM600 or
IEC 61850
Login failed for using the wrong user
credentials
Configuration transferred successfully to
the device
Parameter changed successfully
Parameter change failed
Software updated successfully
Software update failed
User password changed successfully
User password change failed
Software reset
Test mode started
Operation Manual
REX610