Reading An Audit Message - Brocade Communications Systems StoreFabric SN6500B Reference

1
Reading the system messages
TABLE 4
Variable name
Sequence Number
Flags
Severity Level
Switch name
Event-specific information

Reading an Audit message

Compared to RASLog error messages, messages flagged as AUDIT provide additional user and
system-related information of interest for post-event auditing and troubleshooting the problem.
The following example shows the format of the Audit event message.
<Sequence Number> AUDIT, <timestamp>, [<Event ID>], <Severity>, <Event Class>,
<User ID>/<Role>/<IP address>/<Interface>/<Application Name>, <Admin
Domain>/<Switch name>, <Reserved field for future expansion>, <Event-specific
information>
The following is a sample Audit event message.
0 AUDIT, 2005/12/10-09:54:03, [SEC-1000], WARNING, SECURITY,
JohnSmith/root/192.0.2.2/Telnet/CLI, Domain A/JohnsSwitch, , Incorrect password
during login attempt.
24
System message field description (Continued)
Description
The error message position in the log. When a new message is added to the
log, this number is incremented by 1.
The message sequence number starts at 1 after a firmwareDownload and will
increase up to a value of 2,147,483,647 (0x7ffffff).
The sequence number continues to increase after the message log wraps
around, i.e. the oldest message in the log is deleted when a new message is
added. The sequence number can be reset to 1 using the errClear command.
The sequence number is persistent across power cycles and switch reboots.
For most messages, this field contains a space character (null value)
indicating that the message is neither an AUDIT or FFDC message. Messages
may contain the following values:
•
FFDC – Indicates that additional first failure data capture information has
also been generated for this event.
•
FID – The Fabric ID that can range from 0 to 128. FID 128 means the
message was generated by the default switch instance.
•
CHASSIS – The message that was generated by the chassis instance.
•
SLOT number – Indicates the message was generated from slot # blade
main CPU.
•
SLOT #/1 – Indicates the message was generated from slot # blade
Co-CPU.
The severity of the error, which can be one of the following:
•
1 – CRITICAL
•
2 – ERROR
•
3 – WARNING
•
4 – INFO
The defined switch name or the chassis name of the switch depending on the
action; for example, high availability (HA) messages typically show the chassis
name, and login failures show the logical switch name.
This value is truncated if it exceeds 16 characters in length. Run either the
chassisName command to name the chassis or the switchName command to
rename the logical switch.
A text string explaining the error encountered and providing parameters
supplied by the software at runtime.
Fabric OS Message Reference
53-1002749-01