Reading An Audit Message - Brocade Communications Systems SN3000B Reference

TABLE 4
Variable name
Flags
Severity Level
Switch name
Event-specific information

Reading an Audit message

Compared to RASLog error messages, messages flagged as AUDIT provide additional user and
system-related information of interest for post-event auditing and troubleshooting the problem.
The following example shows the format of the Audit event message.
<Sequence Number> AUDIT, <timestamp>, [<Event ID>], <Severity>, <Event Class>,
<User ID>/<Role>/<IP address>/<Interface>/<Application Name>, <Admin
Domain>/<Switch name>, <Reserved field for future expansion>, <Event-specific
information>
The following is a sample Audit event message.
0 AUDIT, 2005/12/10-09:54:03, [SEC-1000], WARNING, SECURITY,
JohnSmith/root/192.168.132.10/Telnet/CLI, Domain A/JohnsSwitch, , Incorrect
password during login attempt.
The fields in the error message are described in
TABLE 5
Variable name
Sequence Number
Audit flag
Fabric OS Message Reference
53-1002448-01
System message field description (Continued)
Description
For most messages, this field contains a space character (null value)
indicating that the message is neither an AUDIT or FFDC message. Messages
may contain the following values:
•
FFDC – Indicates that additional first failure data capture information has
also been generated for this event.
•
FID – The Fabric ID that can range from 0 to 128. FID 128 means the
message was generated by the default switch instance.
•
CHASSIS – The message that was generated by the chassis instance.
•
SLOT number – Indicates the message was generated from slot # blade
main CPU.
•
SLOT #/1 – Indicates the message was generated from slot # blade
Co-CPU.
The severity of the error, which can be one of the following:
•
1 – CRITICAL
•
2 – ERROR
•
3 – WARNING
•
4 – INFO
The defined switch name or the chassis name of the switch depending on the
action; for example, high-availability (HA) messages typically show the chassis
name, and login failures show the logical switch name.
This value is truncated if it exceeds 16 characters in length. Run either the
chassisName command to name the chassis or the switchName command to
rename the logical switch.
A text string explaining the error encountered and providing parameters
supplied by the software at runtime.
Audit message field description
Description
The error message position in the log.
Identifies the message as an Audit message.
Reading the system messages
Table 5.
1
19