Audit Event Messages - Brocade Communications Systems 8 Reference

1
Reading a RAS System Message

Audit Event Messages

Compared to RASLog error messages, messages flagged as AUDIT provide additional user and
system-related information of interest for post event auditing and problem determination.
Audit event message format:
The following is a sample audit event message:
The fields in the error message are described in
TABLE 4
Example
AUDIT
2005/12/10-09:54:03
[SEC-1000]
WARNING
SECURITY
JohnSmith
root
192.168.132.10
Telnet
CLI
Domain A
10
AUDIT, <timestamp>, [<Event ID>], <Severity>, <Event Class>, <User
ID>/<Role>/<IP address>/<Interface>/<app name>. <Admin Domain>/<Switch name>,
<Reserved field for future expansion>, <Event-specific information>
AUDIT, 2005/12/10-09:54:03, [SEC-1000], WARNING, SECURITY,
JohnSmith/root/192.168.132.10/Telnet/CLI, Domain A/JohnsSwitch, , Incorrect
password during login attempt.
Audit Message Field Description
Variable Name
Audit flag
Date and Time Stamp
Message Module and
Message Number
Severity Level
Event Class
User ID
Role
IP Address
Interface
Application Name
Admin Domain
Table 4.
Description
Identifies the message as an Audit message.
The system time (UTC) when the message was
generated on the switch. The RASLog subsystem will
support an internationalized timestamp format base
on the "LOCAL" setting.
The message module and number. These values
uniquely identify each message in the Fabric OS and
reference the cause and actions recommended in this
manual. Note that not all message numbers are used;
there can be gaps in the numeric message sequence.
The severity of the error:
1 = Critical
2 = Error
3 = Warning
4 = Info
The event class:
Zone
Security
Configuration
Firmware
Fabric
The user ID.
The role of the user ID.
The IP address.
The interface being used.
The application name being used on the interface.
The Admin Domain, if there is one.
Fabric OS Message Reference
53-1001767-01