HP NonStop SSH 544701-014 Reference Manual page 284

Event Event
Id Name
1 Authenticat
ionEvent
2 Authenticat
ionEvent
TerminateS
3
essionEvent
4 Subsystem
Event
284 • Monitoring and Auditing
Conditions Pattern
Authentication "%sessionId: %user@%remoteAddress
successful, %action %outcome (method %method):
%reason. System user: %systemUser"
method not
publickey and
not gssapi-with-
mic
Authentication "%sessionId: %user@%remoteAddress
successful, %action %outcome (method %method,
%publickeyOrPrincipal): %reason.
method
System user: %systemUser"
publickey or
gssapi-with-mic
Authentication "%sessionId: %user@%remoteAddress
failed, %action %outcome (method %method):
%reason."
Method not
publickey and
not gssapi-with-
mic
Authentication "%sessionId: %user@%remoteAddress
failed, %action %outcome (method %method,
%publickeyOrPrincipal): %reason."
Method
publickey or
gssi-with-mic
"%sessionId: %user@%remoteAddress
terminate session"
Successful "%sessionId: %user@%remoteAddress
%action %object %outcome"
Token Values
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: 'authentication'
%outcome: 'granted'
%method: authentication method
%reason: reason
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: 'authentication'
%outcome: 'denied' or 'failed'
%method: authentication method
% publickeyOrPrincipal: name of
publickey or principal name
%reason: reason
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: 'authentication'
%outcome: 'granted'
%method: authentication method
%reason: reason
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: 'authentication'
%outcome: 'denied' or 'failed'
%method: authentication method
% publickeyOrPrincipal: name of
publickey or principal
%reason: reason
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: 'subsystem'
%object: name of subsystem
%outcome: 'granted'
HP NonStop SSH Reference Manual