Clearing The Audit Message Log; Configuring Event Auditing - Brocade Communications Systems SN3000B Reference

Clearing the audit message log

To clear the audit message log for a particular switch instance, perform the following steps.
1. Log in to the switch as admin.
2. Execute the auditDump -c command to clear all messages from memory.

Configuring event auditing

To configure event auditing, perform the following steps.
1. Log in to the switch as admin.
2. Execute the auditCfg
3. Execute the auditCfg
4. Execute the auditCfg
5. Execute the auditCfg
Fabric OS Message Reference
53-1002448-01
0 AUDIT, 2011/01/14-06:06:49 (UTC), [RAS-2001], INFO, SYSTEM,
admin/admin/10.70.4.102/telnet/CLI, ad_0/switch/FID 128, , Audit message log
is enabled.
2 AUDIT, 2011/01/14-06:07:03 (UTC), [SEC-3020], INFO, SECURITY,
admin/admin/10.70.4.102/telnet/CLI ad_0/switch, , Event: login, Status:
success, Info: Successful login attempt via SERIAL.
3 AUDIT, 2011/01/14-06:07:33 (UTC), [SULB-1003], INFO, FIRMWARE,
admin/admin/10.70.4.102/telnet/CLI ad_0/switch, , Firmwarecommit has started.
4 AUDIT, 2011/12/11-10:08:58 (UTC), [SULB-1004], INFO, FIRMWARE,
admin/admin/10.70.4.102/telnet/CLI ad_0/switch, , Firmwarecommit has
completed.
[...]
enable command to enable the audit feature.
--
switch:admin> auditcfg --enable
Audit filter is enabled.
class command to configure the event classes you want to audit.
--
switch:admin> auditcfg --class 1,2,3,4,5,6,7
Audit filter is configured.
severity severity level command if you want to set the Audit severity
--
level. By default, all messages are logged. When the severity is set, only messages with the
configured severity and higher are displayed. Valid values for severity level are INFO, WARNING,
ERROR, and CRITICAL
switch:admin> auditcfg --severity ERROR
show command to verify the configuration.
--
switch:admin> auditcfg --show
Audit filter is enabled.
1-ZONE
2-SECURITY
3-CONFIGURATION
4-FIRMWARE
5-FABRIC
6-FW
7-LS
Severity level: ERROR
Displaying, clearing, and configuring Audit messages
1
17