Auditable Events

Introduction

This document provides a overview of auditable events within the system. Auditable events are categorised into different groups based on the type of event, making it easier to manage and understand the events. Each individual event that is produced by the system is represented by a unique Event ID.

Auditable events play a crucial role in maintaining the security and integrity of the system. They provide a detailed record of significant actions and changes, which can be used for various purposes, including:

Security Monitoring: Tracking login attempts, configuration changes, and other critical actions to detect and respond to potential security threats.
Compliance: Ensuring that the system adheres to regulatory requirements by maintaining a detailed audit trail of all significant events.
Troubleshooting: Providing a historical record of events that can be used to diagnose and resolve issues within the system.
Accounting: Keeping track of user activities and system changes to ensure accountability and transparency.

This document also details the format of syslog messages generated for audit events, the configuration options available for managing audit event logging, and the operational commands for viewing and managing the audit log.

Overview

Auditable Event Categories

The auditable events are categorised into different categories, based on the type of the event. The categories are used to group the events into logical groups, making it easier to manage and understand the events. Each individual Event ID will always be associated with a specific category, based on how the Event ID is constructed.

The entire Event ID is a 64-bit value, where the upper 16 bits are used to specify the category of the event, and the lower 48 bits are used to specify the specific event within that category. The following categories are available:

Category ID	Category Name	Description
`0x1000`	Access Control	Events related to access control, such as login, logout, authentication, etc.
`0x2000`	Request Error	Events related to errors in requests, such as invalid requests, unauthorized requests, etc.
`0x3000`	Control System Event	Events related to the control system, such as link up, link down, system reboot, etc.
`0x4000`	Backup Restore Event	Events related to backup and restore operations, such as storing of configuration, etc.
`0x5000`	Configuration Change	Events related to configuration changes, such as specific configuration changes to the system.
`0x5100`	Configuration Transaction	Events related to configuration transactions, such as configuration commit, rollback, etc.
`0x6000`	Audit Log Event	Events related to the audit log, such as audit log display, audit log clear, etc.
`0x7000`	File System Event	Events related to the file system, such as file creation, deletion, modification, etc.
`0x8000`	Configuration Integrity	Events related to configuration integrity, such as configuration integrity check, etc.
`0x9000`	Boot Process Event	Events related to the boot process

Table 1: Auditable Event Categories

Possibly Subject to Change

Since this is a very new addition to the system, it is possible that changes will be made to the Categories in the upcoming releases. The intention is to keep the Categories as stable as possible, but because more changes may be needed early on, it is possible that they will be changed.

Auditable Event Types

Each auditable event is represented by a unique Event ID. The Event ID is a 64-bit value, where the upper 16 bits are used to specify the category of the event, and the lower 48 bits are used to specify the specific event within that category.

The Event ID is constructed in the following manner:

+-----------------+-----------------+-----------------+
| Category        | Main ID         | Sub ID          |
+-----------------+-----------------+-----------------+
| 0xffff          | 0xffffffff      | 0xffff          |
+-----------------+-----------------+-----------------+

As can be seen, the Event ID is divided into three parts:

Category: The upper 16 bits are used to specify the category of the event. This is the exact values defined in the Auditable Event Categories section. Therefore, no Event ID can exist that does not have a valid category, i.e. the initial part of the Event ID will always be a valid category. Therefore, it is always possible to determine the category of an Event ID by looking at the upper 16 bits.
Main ID: The next 32 bits are used to specify the main ID of the event.
Sub ID: The lower 16 bits are used to specify the sub ID of the event. This can be used to further specify an event that is part of a larger category.

As an example, if we take the following Event ID 0x1000000000010010 which represents a successful console login event, we can break it down as follows:

Category: 0x1000 which corresponds to the Access Control category.
Main ID: 0x00000001 which is the main ID of the event.
Sub ID: 0x0010 which is the sub ID of the event.

Possibly Subject to Change

Since this is a very new addition to the system, it is possible that changes will be made to the Event IDs in the upcoming releases. The intention is to keep the Event IDs as stable as possible, but because more changes may be needed early on, it is possible that they will be changed.

However, if changes are made to existing events in the future, the aim is to retire any existing Event IDs, so that they will not be reused for new events. This way, the Event IDs will always be unique, and will not be reused for different events.

Access Control Events

The following Event IDs are available for the Access Control category:

Event ID	Event Name	Description	Note
`0x1000000000010010`	Console login Success	Successful console login event.	-
`0x1000000000010011`	Console login Exit	Console login session ended.	-
`0x1000000000010012`	Console login Failure	Failed console login attempt.	-
`0x1000000000010013`	Suspicious Console login Success	Console login succeeded with suspicious credentials or context.	-
`0x1000000000010014`	Suspicious Console login Failure	Failed console login attempt flagged as suspicious.	-
`0x1000000000010015`	Console login Success secureTTY	Successful console login via secure TTY (trusted terminal).	-
`0x1000000000010020`	SSH login Success	Successful SSH login event.	-
`0x1000000000010021`	SSH login Exit	SSH login session ended.	-
`0x1000000000010022`	SSH login Failure	Failed SSH login attempt.	-
`0x1000000000010023`	Suspicious SSH login Success	SSH login succeeded with suspicious credentials or context.	-
`0x1000000000010024`	Suspicious SSH login Failure	Failed SSH login attempt flagged as suspicious.	-
`0x1000000000010030`	Web login Success	Successful web interface login event.	-
`0x1000000000010031`	Web login Exit	Web login session ended.	-
`0x1000000000010032`	Web login Failure	Failed web login attempt.	-
`0x1000000000010033`	Suspicious Web login Success	Web login succeeded with suspicious credentials or context.	-
`0x1000000000010034`	Suspicious Web login Failure	Failed web login attempt flagged as suspicious.	-
`0x1000000000010040`	Telnet login Success	Successful Telnet login event.	-
`0x1000000000010041`	Telnet login Exit	Telnet login session ended.	-
`0x1000000000010042`	Telnet login Failure	Failed Telnet login attempt.	-
`0x1000000000010043`	Suspicious Telnet login Success	Telnet login succeeded with suspicious credentials or context.	-
`0x1000000000010044`	Suspicious Telnet login Failure	Failed Telnet login attempt flagged as suspicious.	-
`0x1000000000010050`	Other login Success	Successful login via other (non-standard) method.	-
`0x1000000000010051`	Other login Exit	Other login session ended.	-
`0x1000000000010052`	Other login Failure	Failed login attempt via other method.	-
`0x1000000000010053`	Suspicious Other login Success	Other login succeeded with suspicious credentials or context.	-
`0x1000000000010054`	Suspicious Other login Failure	Failed other login attempt flagged as suspicious.	-
`0x1000000000020000`	SNMPv3 Access Success	Successful SNMPv3 access.	-
`0x1000000000020001`	SNMPv3 Access Failure	Failed SNMPv3 access attempt.	-
`0x1000000000020002`	SNMPv3 Engine ID Failure	SNMPv3 engine ID verification failed.	-
`0x1000000000020003`	SNMPv2 Access Success	Successful SNMPv2 access.	-
`0x1000000000020004`	SNMPv2 Access Failure	Failed SNMPv2 access attempt.	-
`0x1000000000020005`	SNMP Command Success	SNMP command executed successfully.	-
`0x1000000000020006`	SNMP Command Failure	SNMP command execution failed.	-
`0x1000000000030000`	Enter CLI Shell	Entered CLI shell session.	-
`0x1000000000030001`	Exit CLI Shell	Exited CLI shell session.	-
~~`0x1000000000040001`~~	~~Authorised MAC address through mac-authentication~~	~~MAC address authorised via MAC authentication.~~	Deprecated
~~`0x1000000000040002`~~	~~De-authorised MAC address through mac-authentication~~	~~MAC address de-authorised via MAC authentication .~~	Deprecated
~~`0x1000000000040003`~~	~~Authentication through mac-authentication failed~~	~~MAC authentication attempt failed .~~	Deprecated
`0x1000000000040008`	Authorised MAC address through MAB	Authorised MAC address through MAB.	-
`0x1000000000040009`	De-authorised MAC address through MAB	De-authorised MAC address through MAB.	-
`0x100000000004000A`	Authentication through MAB failed	Authentication through MAB failed.	-
`0x100000000004000B`	Assign port to VID from radius server through MAB	Assign port to VID from radius server through MAB.	-
`0x100000000004000C`	Assign port to VID from ports default through MAB	Assign port to VID from ports default through MAB.	-
`0x100000000004000D`	Assign port to start VID, nothing authenticated through MAB	Assign port to start VID, nothing authenticated through MAB.	-
`0x100000000004000E`	No allowed VID provided in radius server response for MAB	No allowed VID provided in radius server response for MAB.	-
`0x100000000004000F`	Default VLAN disabled for MAB	Default VLAN disabled for MAB.	-
`0x1000000000040010`	Port is already assigned to a different VID, cannot be assigned by MAB	Port is already assigned to a different VID, cannot be assigned by MAB.	-
`0x1000000000040011`	Port unlocked MAB Port Mode	Port unlocked MAB Port Mode.	-
`0x1000000000040012`	Port locked MAB Port Mode	Port locked MAB Port Mode.	-
`0x1000000000040013`	Authorised MAC address through MAC Whitelist	Authorised MAC address through MAC Whitelist.	-
`0x1000000000040014`	De-authorised MAC address through MAC Whitelist	De-authorised MAC address through MAC Whitelist.	-
`0x1000000000040015`	Authentication through MAC Whitelist failed	Authentication through MAC Whitelist failed.	-
`0x1000000000040016`	Port unlocked MAC Whitelist Port Mode	Port unlocked MAC Whitelist Port Mode.	-
`0x1000000000040017`	Port locked MAC Whitelist Port Mode	Port locked MAC Whitelist Port Mode.	-
~~`0x1000000000040004`~~	~~Authorised MAC address through 802.1X~~	~~MAC address authorised via IEEE 802.1X authentication.~~	Deprecated
~~`0x1000000000040005`~~	~~De-authorised MAC address through 802.1X~~	~~MAC address de-authorised via IEEE 802.1X authentication.~~	Deprecated
~~`0x1000000000040006`~~	~~Authentication through 802.1X failed~~	~~IEEE 802.1X authentication failed.~~	Deprecated
~~`0x1000000000040007`~~	~~IPsec Authentication failed~~	~~IPsec Authentication failed .~~	Deprecated
`0x1000000000050001`	Authorised MAC address through 802.1X	MAC address authorised via IEEE 802.1X authentication.	-
`0x1000000000050002`	De-authorised MAC address through 802.1X	MAC address de-authorised via IEEE 802.1X authentication.	-
`0x1000000000050003`	Authentication through 802.1X failed	IEEE 802.1X authentication failed.	-
`0x1000000000050004`	Assign port to VID from radius server through 802.1X	Assign port to VID from radius server through 802.1X.	-
`0x1000000000050005`	Assign port to VID from ports default through 802.1X	Assign port to VID from ports default through 802.1X.	-
`0x1000000000050006`	Assign port to start VID, nothing authenticated through 802.1X	Assign port to start VID, nothing authenticated through 802.1X.	-
`0x1000000000050007`	No allowed VID provided in radius server response for 802.1X	No allowed VID provided in radius server response for 802.1X.	-
`0x1000000000050008`	Default VLAN disabled for 802.1X	Default VLAN disabled for 802.1X.	-
`0x1000000000050009`	Port is already assigned to a different VID, cannot be assigned by 802.1X	Port is already assigned to a different VID, cannot be assigned by 802.1X.	-
`0x1000000000050010`	Port unlocked 802.1X Port Mode	Port unlocked 802.1X Port Mode.	-
`0x1000000000050011`	Port locked 802.1X Port Mode	Port locked 802.1X Port Mode.	-
`0x1000000000060001`	IPsec Authentication failed	IPsec Authentication failed.	-

Table 2: Access Control Events

Request Error Events

The following Event IDs are available for the Request Error category:

Event ID	Event Name	Description	Note
`0x2000000000010000`	Unauthorised CLI Command	Attempt to execute a CLI command without proper authorisation.	-
`0x2000000000020000`	SNMP OID Request Success	SNMP OID request completed successfully.	-
`0x2000000000020001`	SNMP OID Request Failure	SNMP OID request failed (e.g., due to permissions or bad OID).	-
`0x2000000000030000`	Unauthorised SSH User	SSH login attempt by unauthorised user.	-
`0x2000000000030001`	Unauthorised Web User	Web login attempt by unauthorised user.	-
`0x2000000000030002`	Unauthorised Console User	Console login attempt by unauthorised user.	-

Table 3: Request Error Events

Control System Events

The following Event IDs are available for the Control System Event category:

Event ID	Event Name	Description	Note
`0x3000000000010001`	Service Start	A system service has started.	-
`0x3000000000010002`	Service Stop	A system service has stopped. Some services will also be stopped and started as part of their restart handling.	-
`0x3000000000010003`	Service Restart	A system service has restarted. Typically this can occur during system reconfiguration.	-
`0x3000000000010004`	Service Died	A system service has unexpectedly terminated. The system will attempt to restart it.	-
`0x3000000000010005`	Service Crash	A system service has crashed. It has died too many times within a short period and attempts to restart it will cease, it is now considered crashed.	-
`0x3000000000010006`	Service Crash Restart	A system service crashed and was automatically restarted.	-
`0x3000000000020001`	Link Up	A network link became active.	-
`0x3000000000020002`	Link Down	A network link became inactive.	-
`0x3000000000030001`	System Boot	The system has booted.	-
`0x3000000000030002`	System Startup	The system startup process has completed.	-
`0x3000000000030003`	System Operational	The system is now operational.	-
`0x3000000000030004`	System Shutdown	The system is shutting down.	-
`0x3000000000030005`	System Upgrade	A system upgrade has occurred.	-
`0x3000000000030006`	System Upgrade Failed	System Upgrade Failed.	-
`0x3000000000030007`	System Upgrade Validation Passed	System Upgrade Validation Passed.	-
`0x3000000000030008`	System Upgrade Validation Failed	System Upgrade Validation Failed.	-
`0x3000000000040000`	ECSC Communication Established	ECSC communication channel established.	-
`0x3000000000040001`	TTDP Stack Ready	TTDP protocol stack is ready.	-
`0x3000000000050002`	DHCP Client Lease Deconfig	DHCP client lease deconfigured.	-
`0x3000000000050003`	DHCP Client Lease Renew	DHCP client lease renewed.	-
`0x3000000000050004`	DHCP Client Lease Bound	DHCP client lease bound to an address.	-
`0x3000000000050005`	DHCP Client Received NAK	DHCP client received a negative acknowledgment (NAK).	-
`0x3000000000050006`	DHCP Client Lease Failed	DHCP client lease acquisition failed.	-
`0x3000000000050100`	DHCP Server Discover	DHCP server received a discover message.	-
`0x3000000000050101`	DHCP Server Offer	DHCP server sent an offer message.	-
`0x3000000000050102`	DHCP Server Request	DHCP server received a request message.	-
`0x3000000000050103`	DHCP Server Acknowledge	DHCP server sent an acknowledge message.	-
`0x3000000000050104`	DHCP Server Release	DHCP server received a release message.	-
`0x3000000000050105`	DHCP Server NAK	DHCP server sent a negative acknowledgment (NAK).	-
`0x3000000000050106`	DHCP Server Decline	DHCP server received a decline message.	-
`0x3000000000050107`	DHCP Server Inform	DHCP server received an inform message.	-
`0x3000000000050108`	DHCP Server No Address Available	DHCP server has no address available to assign.	-
`0x3000000000060001`	Configuration Changed	A configuration change was made.	-
`0x3000000000070001`	Enter Maintenance Mode	System entered maintenance mode.	-
`0x3000000000070002`	Exit Maintenance Mode	System exited maintenance mode.	-
`0x3000000000080000`	MRP Ring OK	MRP ring is operational.	-
`0x3000000000080001`	MRP Ring Broken	MRP ring is broken.	-
`0x3000000000090000`	NTP Clock Synchronised	NTP clock synchronised successfully.	-
`0x3000000000090001`	NTP Update Failed	NTP clock update failed.	-
`0x30000000000a0000`	FRNT Ring OK	FRNT ring is operational.	-
`0x30000000000a0001`	FRNT Ring Broken	FRNT ring is broken.	-
`0x30000000000b0000`	Duplicate IP Address	A duplicate IP address was detected.	-
`0x30000000000b0001`	Duplicate MAC Address	A duplicate MAC address was detected.	-
`0x30000000000b0002`	ARP New Entry	A new ARP entry was added.	-
`0x30000000000b0003`	ARP Entry Changed	An ARP entry was changed.	-
`0x30000000000b0004`	ARP Entry Flip Flop	ARP entry is rapidly changing (flip-flop detected).	-
`0x30000000000c0000`	RICO Port State Change	RICO port state changed.	-
`0x30000000000d0000`	ATU Full Violation	Address Translation Unit (ATU) is full.	-
`0x30000000000e0000`	Unknown IPv4 Route Install	An unknown IPv4 route was installed.	-
`0x30000000000e0001`	Unknown IPv4 Route Delete	An unknown IPv4 route was deleted.	-
`0x30000000000e0002`	Kernel IPv4 Route Install	A kernel IPv4 route was installed.	-
`0x30000000000e0003`	Kernel IPv4 Route Delete	A kernel IPv4 route was deleted.	-
`0x30000000000e0004`	Connected IPv4 Route Install	A connected IPv4 route was installed.	-
`0x30000000000e0005`	Connected IPv4 Route Delete	A connected IPv4 route was deleted.	-
`0x30000000000e0006`	Static IPv4 Route Install	A static IPv4 route was installed.	-
`0x30000000000e0007`	Static IPv4 Route Delete	A static IPv4 route was deleted.	-
`0x30000000000e0008`	RIP IPv4 Route Install	A RIP IPv4 route was installed.	-
`0x30000000000e0009`	RIP IPv4 Route Delete	A RIP IPv4 route was deleted.	-
`0x30000000000e000a`	OSPF IPv4 Route Install	An OSPF IPv4 route was installed.	-
`0x30000000000e000b`	OSPF IPv4 Route Delete	An OSPF IPv4 route was deleted.	-
`0x30000000000e000c`	Kernel IPv6 Route Install	A kernel IPv6 route was installed.	-
`0x30000000000e000d`	Kernel IPv6 Route Delete	A kernel IPv6 route was deleted.	-
`0x30000000000e000e`	Connected IPv6 Route Install	A connected IPv6 route was installed.	-
`0x30000000000e000f`	Connected IPv6 Route Delete	A connected IPv6 route was deleted.	-
`0x30000000000e0010`	Static IPv6 Route Install	A static IPv6 route was installed.	-
`0x30000000000e0011`	Static IPv6 Route Delete	A static IPv6 route was deleted.	-
`0x30000000000e0012`	RIP IPv6 Route Install	A RIP IPv6 route was installed.	-
`0x30000000000e0013`	RIP IPv6 Route Delete	A RIP IPv6 route was deleted.	-
`0x30000000000e0014`	OSPF IPv6 Route Install	An OSPF IPv6 route was installed.	-
`0x30000000000e0015`	OSPF IPv6 Route Delete	A OSPF IPv6 route was deleted.	-
`0x30000000000e0016`	Unknown IPv6 Route Install	An unknown IPv6 route was installed.	-
`0x30000000000e0017`	Unknown IPv6 Route Delete	An unknown IPv6 route was deleted.	-
`0x30000000000e0018`	Multicast IPv4 Route Install	A multicast IPv4 route was installed.	-
`0x30000000000e0019`	Multicast IPv4 Route Delete	A multicast IPv4 route was deleted.	-
`0x30000000000f0000`	Link Alarm Actived	A link alarm was activated.	-
`0x30000000000f0001`	Link Alarm Deactived	A link alarm was deactivated.	-
`0x30000000000f0002`	Temp Alarm Actived	A temperature alarm was activated.	-
`0x30000000000f0003`	Temp Alarm Deactived	A temperature alarm was deactivated.	-
`0x30000000000f0004`	Power Alarm Actived	A power alarm was activated.	-
`0x30000000000f0005`	Power Alarm Deactived	A power alarm was deactivated.	-
`0x30000000000f0006`	Digin Alarm Actived	A digital input alarm was activated.	-
`0x30000000000f0007`	Digin Alarm Deactived	A digital input alarm was deactivated.	-
`0x30000000000f0008`	Ping Alarm Actived	A ping alarm was activated.	-
`0x30000000000f0009`	Ping Alarm Deactived	A ping alarm was deactivated.	-
`0x30000000000f000a`	FRNT Alarm Actived	A FRNT alarm was activated.	-
`0x30000000000f000b`	FRNT Alarm Deactived	A FRNT alarm was deactivated.	-
`0x30000000000f000c`	Ring Alarm Actived	A ring alarm was activated.	-
`0x30000000000f000d`	Ring Alarm Deactived	A ring alarm was deactivated.	-
`0x30000000000f000e`	Profinet Alarm Actived	A Profinet alarm was activated.	-
`0x30000000000f000f`	Profinet Alarm Deactived	A Profinet alarm was deactivated.	-
`0x30000000000f0010`	POE Alarm Actived	A PoE alarm was activated.	-
`0x30000000000f0011`	POE Alarm Deactived	A PoE alarm was deactivated.	-
`0x30000000000f0012`	RICO Alarm Actived	A RICO alarm was activated.	-
`0x30000000000f0013`	RICO Alarm Deactived	A RICO alarm was deactivated.	-
`0x30000000000f0014`	Media Threshold Alarm Actived	A media threshold alarm was activated.	-
`0x30000000000f0015`	Media Threshold Alarm Deactived	A media threshold alarm was deactivated.	-
`0x30000000000f0016`	Media Plug Alarm Actived	A media plug alarm was activated.	-
`0x30000000000f0017`	Media Plug Alarm Deactived	A media plug alarm was deactivated.	-
`0x3000000000100000`	Media Plugged In	A media device, e.g. a USB device or SD card, was plugged in. This does not indicate that the device has been mounted or is ready for use.	-
`0x3000000000100001`	Media Removed	A media device was removed.	-
`0x3000000000100002`	Media Mounted	A media device was mounted. The device is now available and ready for use.	-
`0x3000000000100003`	Media Unmounted	A media device was unmounted.	-
`0x3000000000100004`	Media Mount Failed	Media Mount Failed.	-
`0x3000000000110000`	Firewall Allow Rule Hit	A firewall allow rule was hit.	-
`0x3000000000110001`	Firewall Deny Rule Hit	A firewall deny rule was hit.	-
`0x3000000000110002`	Firewall DSCP Rule Hit	A firewall DSCP rule was hit.	-
`0x3000000000110003`	Firewall Port Forwarding Rule Hit	A firewall port forwarding rule was hit.	-
`0x3000000000110004`	Firewall NAT Rule Hit	A firewall NAT rule was hit.	-
`0x3000000000120000`	Certificate has been revoked	A certificate was revoked.	-
`0x3000000000120001`	CRL distribution point not accessible	The Certificate Revocation List (CRL) distribution point could not be accessed.	-
`0x3000000000120002`	CRL expired	The Certificate Revocation List (CRL) has expired.	-
`0x3000000000120003`	CRL signature verification failed	CRL signature verification failed.	-
`0x3000000000120004`	CRL too large for download	CRL was too large to download.	-
`0x3000000000120005`	SSH host key management	SSH host key management event occurred.	-
`0x3000000000120006`	SSH host key management failure	SSH host key management failure event occurred.	-
`0x3000000000120007`	Weak/deprecated certificate used	Weak/deprecated certificate used.	-
`0x3000000000130000`	Custom Telegram Publish	Custom Telegram Publish.	-
`0x3000000000130001`	Custom Telegram Subscribe	Custom Telegram Subscribe.	-
`0x3000000000130002`	Custom Telegram System Clock Changed	Custom telegram indicating system clock change.	-
`0x3000000000130003`	Custom Telegram Inhibit Flag Changed	Custom telegram indicating inhibit flag change.	-
`0x3000000000130004`	Custom Telegram Bypass-relay Changed	Custom telegram indicating bypass-relay change.	-
`0x3000000000140000`	Package Installed	A software package has been installed.	-
`0x3000000000140001`	Package Removed	A software package has been removed.	-
`0x3000000000150000`	TPM Error	A Trusted Platform Module (TPM) error occurred.	-
`0x3000000000160000`	System time manually set	System time manually set.	-
`0x3000000000160001`	System time manually set failure	Failure occurred while manually setting system time.	-
`0x3000000000160002`	RTC time manually set	Real-Time Clock (RTC) time was manually set.	-
`0x3000000000160003`	RTC time manually set failure	Failure occurred while manually setting RTC time.	-
`0x3000000000160004`	RTC chip incorrectly configured	RTC chip incorrectly configured.	-
`0x3000000000160005`	Failed setting configuration for RTC chip	Failed setting configuration for RTC chip.	-
`0x3000000000170000`	IPsec Closing Child SA	IPsec is closing a Child Security Association (SA).	-
`0x3000000000170001`	IPsec Established Child SA	IPsec has established a Child Security Association (SA).	-
`0x3000000000170002`	IPsec Reauth IKE SA	IPsec Reauth Internet Key Exchange (IKE) Security Association (SA).	-
`0x3000000000170003`	IPsec Closing IKE SA	IPsec Closing Internet Key Exchange (IKE) Security Association (SA).	-
`0x3000000000180000`	App Start	A container application was started.	-
`0x3000000000180001`	App Stop	A container application was stopped.	-
`0x3000000000180002`	App Restart	A container application was restarted.	-
`0x3000000000180003`	App Attach	A user attached to a running application container console.	-
`0x3000000000180004`	App Reload	An application was reloaded after configuration or image label changes.	-
`0x3000000000180005`	App Update Label On Image	An image label was updated or assigned to an application image.	-
`0x3000000000180006`	App Load All	All configured applications were loaded and initialized.	-
`0x3000000000180007`	App Signature Verification	An application image signature was verified.	-
`0x3000000000180008`	App Delete	An application instance or application image was deleted.	-

Table 4: Control System Events

Note that this simply lists what can be logged, what is logged is dependent on the configuration of the system. For instance, no audit events will be generated related to DHCP server if no DHCP server is configured.

Backup Restore Events

The following Event IDs are available for the Backup Restore Event category:

Event ID	Event Name	Description	Note
`0x4000000000010000`	Update Running Configuration	The system running configuration was updated after successful activation.	-
`0x4000000000020000`	Read Config File	A configuration file was read.	-
`0x4000000000020001`	Read Config File Error	Failed to read configuration file.	-
`0x4000000000020002`	Read Config File Error - JSON	JSON parsing error while reading the configuration file.	-
`0x4000000000020003`	Read Config File Error - No Exist	Configuration file not found.	-
`0x4000000000030000`	Validate Config File	Configuration file validation was initiated.	-
`0x4000000000040000`	Write Config File	Configuration was written to file.	-
`0x4000000000040001`	Write Config File Error	Failed to open configuration file for writing.	-
`0x4000000000040002`	Write Config File Error - JSON	JSON formatting or encoding error while writing the configuration file.	-
`0x4000000000050000`	Copied Config File - CLI	Configuration file copied via CLI command.	-
`0x4000000000050001`	Copy Config File Error - CLI	Error occurred while copying configuration file via CLI.	-
`0x4000000000060000`	Verify Config File Encryption	Configuration file encryption verification.	-
`0x4000000000070000`	Support File Generated	A support file for troubleshooting was created.	-
`0x4000000000080000`	JSON Schema validation successful	Configuration file passed JSON schema validation.	-
`0x4000000000080001`	JSON Schema validation fail	Configuration file failed JSON schema validation.	-
`0x4000000000080002`	JSON Schema validation fail with error	Configuration file failed JSON schema validation with specific error details.	-
`0x4000000000080003`	JSON Schema validation fail, force apply	Configuration was force applied despite JSON schema validation failure.	-
`0x4000000000080004`	JSON Schema validation fail, force copy	Configuration file was force copied despite JSON schema validation failure.	-
`0x4000000000090000`	Web Enable Config Force Apply	Force apply option temporarily enabled for current web session.	-
`0x4000000000090001`	Web Disable Config Force Apply	Force apply option disabled for current web session.	-
`0x4000000000090002`	Web Config Force Apply	Configuration change was force applied via web interface, validation checks were ignored.	-

Table 5: Backup Restore Events

Configuration Change Events

The following Event IDs are available for the Configuration Change category:

Event ID	Event Name	Description	Note
`0x5000000000020000`	LLDP	Configuration change related to LLDP (Link Layer Discovery Protocol).	-
`0x5000000000020001`	LLDP Port	Configuration change for an LLDP-enabled port.	-
`0x5000000000030000`	DHCP Server	Configuration change to the DHCP server settings.	-
`0x5000000000030001`	DHCP Server Subnet	Configuration change to a DHCP server subnet.	-
`0x5000000000030002`	DHCP Server Host	Configuration change to a DHCP server host entry.	-
`0x5000000000030003`	DHCP Server Route	Configuration change to a DHCP server route.	-
`0x5000000000030004`	DHCP Server Host Match	Configuration change to DHCP server host matching rules.	-
`0x5000000000030005`	DHCP Server Static Leases	Configuration change to DHCP server static lease assignments.	-
`0x5000000000040000`	SSH	Configuration change related to SSH settings.	-
`0x5000000000040001`	SSH Shell access	Configuration change for SSH shell access permissions.	-
`0x5000000000050000`	Telnet	Configuration change related to Telnet settings.	-
`0x5000000000060000`	Port	Configuration change to a network port.	-
`0x5000000000060001`	Ethernet Port	Configuration change to an Ethernet port.	-
`0x5000000000070000`	Ownership	Configuration change to system or resource ownership.	-
`0x5000000000080000`	System	General system configuration change.	-
`0x5000000000090000`	TFTP	Configuration change related to TFTP settings.	-
`0x50000000000a0000`	DNS	Configuration change related to DNS settings.	-
`0x50000000000a0001`	DNS Forward Rule	Configuration change to DNS forwarding rules.	-
`0x50000000000a0002`	DNS Server	Configuration change to a DNS server entry.	-
`0x50000000000a0003`	DNS Host	Configuration change to a DNS host entry.	-
`0x50000000000a0004`	DNS Search Path	Configuration change to DNS search path settings.	-
`0x50000000000b0000`	NTP	Configuration change related to NTP (Network Time Protocol) settings.	-
`0x50000000000b0001`	NTP Client	Configuration change to NTP client settings.	-
`0x50000000000c0000`	WEB	Configuration change related to web interface settings.	-
`0x50000000000c0001`	HTTP	Configuration change to HTTP settings.	-
`0x50000000000c0002`	HTTPS	Configuration change to HTTPS settings.	-
`0x50000000000d0000`	RSTP	Configuration change related to RSTP (Rapid Spanning Tree Protocol).	-
`0x50000000000d0001`	RSTP Port	Configuration change to an RSTP-enabled port.	-
`0x50000000000e0000`	FRNT	Configuration change related to FRNT (Fast Recovery Network Topology).	-
`0x50000000000e0001`	FRNT Port	Configuration change to a FRNT port.	-
`0x50000000000f0000`	ICMP	Configuration change related to ICMP (Internet Control Message Protocol) settings.	-
`0x5000000000100000`	Management	Configuration change to management interface or settings.	-
`0x5000000000110000`	Password	Configuration change to a password or password policy.	-
`0x5000000000120000`	VRRP	Configuration change related to VRRP (Virtual Router Redundancy Protocol).	-
`0x5000000000120001`	VRRP Trigger	Configuration change to VRRP trigger settings.	-
`0x5000000000120002`	VRRP Instance	Configuration change to a VRRP instance.	-
`0x5000000000120003`	VRRP Group	Configuration change to a VRRP group.	-
`0x5000000000130000`	RIP Interface	Configuration change to a RIP (Routing Information Protocol) interface.	-
`0x5000000000130001`	RIP Interface MD5	Configuration change to RIP interface MD5 authentication.	-
`0x5000000000130002`	RIP Interface Secret	Configuration change to RIP interface secret settings.	-
`0x5000000000130003`	RIP Interface Auth	Configuration change to RIP interface authentication settings.	-
`0x5000000000140000`	RIP	Configuration change related to RIP protocol.	-
`0x5000000000140001`	RIP Network	Configuration change to a RIP network entry.	-
`0x5000000000150000`	OSPF Interface	Configuration change to an OSPF (Open Shortest Path First) interface.	-
`0x5000000000150001`	OSPF Interface MD5	Configuration change to OSPF interface MD5 authentication.	-
`0x5000000000150002`	OSPF Interface Secret	Configuration change to OSPF interface secret settings.	-
`0x5000000000150003`	OSPF Interface Auth	Configuration change to OSPF interface authentication settings.	-
`0x5000000000160000`	OSPF	Configuration change related to OSPF protocol.	-
`0x5000000000160001`	OSPF Network	Configuration change to an OSPF network entry.	-
`0x5000000000160002`	OSPF Area	Configuration change to an OSPF area.	-
`0x5000000000160003`	OSPF Timers	Configuration change to OSPF timer settings.	-
`0x5000000000160004`	OSPF Redistribute	Configuration change to OSPF route redistribution settings.	-
`0x5000000000160005`	OSPF Distribute Default	Configuration change to OSPF default route distribution.	-
`0x5000000000170000`	PIM Interface	Configuration change to a PIM (Protocol Independent Multicast) interface.	-
`0x5000000000180000`	PIM	Configuration change related to PIM protocol.	-
`0x5000000000180001`	PIM Rendezvous Point	Configuration change to a PIM rendezvous point.	-
`0x5000000000180002`	PIM Policy	Configuration change to a PIM policy.	-
`0x5000000000180003`	PIM SSM Prefix	Configuration change to a PIM SSM (Source-Specific Multicast) prefix.	-
`0x5000000000190000`	Interface	Configuration change to a network interface.	-
`0x5000000000190001`	Interface IPv4	Configuration change to an IPv4 interface.	-
`0x5000000000190002`	Interface IPv4 Address	Configuration change to an IPv4 address on an interface.	-
`0x5000000000190003`	Interface IPv6	Configuration change to an IPv6 interface.	-
`0x50000000001a0000`	IP	Configuration change related to IP settings.	-
`0x50000000001a0001`	IP Route	Configuration change to an IP route.	-
`0x50000000001a0002`	IP Multicast Route	Configuration change to an IP multicast route.	-
`0x50000000001a0003`	IP NAT	Configuration change to IP NAT (Network Address Translation) settings.	-
`0x50000000001a0004`	Policy Route Match Ip	Configuration change to policy route IP match settings.	-
`0x50000000001a0005`	IP Policy Route Match	Configuration change to IP policy route match rules.	-
`0x50000000001a0006`	IP Policy Route	Configuration change to an IP policy route.	-
`0x50000000001b0000`	Firewall	Configuration change related to firewall settings.	-
`0x50000000001b0001`	Firewall Network	Configuration change to a firewall network object.	-
`0x50000000001b0002`	Firewall Rule	Configuration change to a firewall rule.	-
`0x50000000001b0003`	Firewall Counter	Configuration change to a firewall counter.	-
`0x50000000001b0004`	Firewall Log	Configuration change to firewall logging settings.	-
`0x50000000001c0000`	PoE	Configuration change related to Power over Ethernet (PoE) settings.	-
`0x50000000001c0001`	PoE Port	Configuration change to a PoE-enabled port.	-
`0x50000000001d0000`	AAA	Configuration change related to AAA (Authentication, Authorization, Accounting) settings.	-
`0x50000000001d0001`	AAA User SSH Key	Configuration change to a user's SSH key in AAA settings.	-
`0x50000000001d0002`	AAA User	Configuration change to a user in AAA settings.	-
`0x50000000001d0003`	AAA Local User	Configuration change to a local user in AAA settings.	-
`0x50000000001d0004`	AAA Local Database	Configuration change to the AAA local user database.	-
`0x50000000001d0005`	AAA Remote Server	Configuration change to a remote AAA server.	-
`0x50000000001d0006`	AAA Server Group	Configuration change to a AAA server group.	-
`0x50000000001d0007`	AAA Server	Configuration change to a AAA server entry.	-
`0x50000000001d0008`	AAA Method	Configuration change to a AAA authentication method.	-
`0x50000000001d0009`	AAA MAC Pattern	Configuration change to a AAA MAC address pattern.	-
`0x50000000001d000a`	AAA Authentication	Configuration change to AAA authentication settings.	-
`0x50000000001d000b`	AAA 802.1x Auth Groups	Configuration change to AAA 802.1x authentication groups.	-
`0x50000000001d000c`	AAA MAC Auth Groups	Configuration change to AAA MAC authentication groups.	-
`0x50000000001d000d`	AAA Login Auth Groups	Configuration change to AAA login authentication groups.	-
`0x50000000001d000e`	AAA Password Policy	Configuration change to AAA password policy.	-
`0x50000000001d000f`	AAA Lockout Policy	Configuration change to AAA lockout policy.	-
`0x50000000001d0010`	AAA Authentication Chain	AAA Authentication Chain.	-
`0x50000000001e0000`	SSL	Configuration change related to SSL (Secure Sockets Layer) settings.	-
`0x50000000001e0001`	SSL Network	Configuration change to an SSL network object.	-
`0x50000000001e0002`	SSL Pool Range	Configuration change to SSL pool range settings.	-
`0x50000000001e0003`	SSL Internal Route	Configuration change to an SSL tunnel.	-
`0x50000000001e0004`	SSL Client Config	Configuration change to SSL client configuration.	-
`0x50000000001f0000`	Generic Routing Encap	Configuration change to GRE (Generic Routing Encapsulation) settings.	-
`0x5000000000200000`	Audit Logging	Configuration change to audit logging settings.	-
`0x5000000000210000`	IPSec	Configuration change related to IPSec (IP Security) settings.	-
`0x5000000000210001`	IPSec Remote CA	Configuration change to IPSec remote certificate authority settings.	-
`0x5000000000210002`	IPSec Protocol Port	Configuration change to IPSec protocol port settings.	-
`0x5000000000220000`	Tunnel	Configuration change to a network tunnel.	-
`0x5000000000220001`	SSL Tunnel	Configuration change to an SSL tunnel.	-
`0x5000000000220002`	GRE Tunnel	Configuration change to a GRE tunnel.	-
`0x5000000000220003`	IPSec Tunnel	Configuration change to an IPSec tunnel.	-
`0x5000000000230000`	IPv6	Configuration change related to IPv6 settings.	-
`0x5000000000230001`	IPv6 Route	Configuration change to an IPv6 route.	-
`0x5000000000240000`	PTP	Configuration change related to PTP (Precision Time Protocol) settings.	-
`0x5000000000240001`	PTP Clock	Configuration change to a PTP clock.	-
`0x5000000000240002`	PTP Parameters	Configuration change to PTP parameters.	-
`0x5000000000250000`	TTDP	Configuration change related to TTDP (Time-Triggered Data Protocol) settings.	-
`0x5000000000250001`	TTDP ECN	Configuration change to TTDP ECN (Explicit Congestion Notification) settings.	-
`0x5000000000250002`	TTDP Multicast Route	Configuration change to TTDP multicast route settings.	-
`0x5000000000250003`	TTDP Port	Configuration change to a TTDP port.	-
`0x5000000000250004`	TTDP Internet	Configuration change to TTDP internet settings.	-
`0x5000000000250005`	TTDP Custom TRDP	Configuration change to TTDP CUTE (Custom User Traffic Engineering) settings.	-
`0x5000000000250006`	TTDP Custom TRDP Alias	TTDP Custom TRDP Alias.	-
`0x5000000000260000`	Watchdog	Configuration change to watchdog settings.	-
`0x5000000000260001`	Watchdog Monitor	Configuration change to watchdog monitor settings.	-
`0x5000000000270000`	VLAN	Configuration change related to VLAN (Virtual LAN) settings.	-
`0x5000000000270001`	VLAN Commons	Configuration change to common VLAN settings.	-
`0x5000000000270002`	VLAN dbnum	Configuration change to VLAN database number.	-
`0x5000000000280000`	LAG	Configuration change related to LAG (Link Aggregation Group) settings.	-
`0x5000000000280001`	LAG LACP	Configuration change to LAG LACP (Link Aggregation Control Protocol) settings.	-
`0x5000000000280002`	LAG TTPD	Configuration change to LAG TTPD settings.	-
`0x5000000000280003`	LAG Port	Configuration change to a LAG port.	-
`0x5000000000290000`	Action	Configuration change to an action or action list.	-
`0x5000000000290001`	Action Interface	Configuration change to an action interface list.	-
`0x50000000002a0000`	Trigger	Configuration change to a trigger or trigger list.	-
`0x50000000002b0000`	Alarm	Configuration change to an alarm or alarm settings.	-
`0x50000000002b0001`	Alarm Trigger	Configuration change to an alarm trigger list.	-
`0x50000000002b0002`	Alarm Action	Configuration change to an alarm action list.	-
`0x50000000002c0000`	Ring	Configuration change related to ring topology settings.	-
`0x50000000002c0001`	Ring Port	Configuration change to a ring port.	-
`0x50000000002c0002`	Ring MRP	Configuration change to ring MRP (Media Redundancy Protocol) settings.	-
`0x50000000002d0000`	Console	Configuration change to console access or settings.	-
`0x50000000002e0000`	RiCo	Configuration change related to RiCo (Ring Coupling) settings.	-
`0x50000000002e0001`	RiCo Coupling Port	Configuration change to a RiCo coupling port.	-
`0x50000000002e0002`	RiCo Subring	Configuration change to a RiCo subring.	-
`0x50000000002f0000`	DDNS	Configuration change related to DDNS (Dynamic DNS) settings.	-
`0x50000000002f0001`	DDNS Provider	Configuration change to a DDNS provider.	-
`0x50000000002f0002`	DDNS Custom Provider	Configuration change to a custom DDNS provider.	-
`0x50000000002f0003`	DDNS Builtin Provider	Configuration change to a built-in DDNS provider.	-
`0x5000000000300000`	Application Container	Configuration change to an application container.	-
`0x5000000000300001`	Application Container Share	Configuration change to an application container share.	-
`0x5000000000300002`	App Environment Variable	Configuration change to an application environment variable.	-
`0x5000000000300003`	App Capability	App Capability.	-
`0x5000000000310000`	SNMP	Configuration change related to SNMP (Simple Network Management Protocol) settings.	-
`0x5000000000310001`	SNMP Address	Configuration change to an SNMP IP address.	-
`0x5000000000310002`	SNMP User	Configuration change to an SNMP user.	-
`0x5000000000310003`	SNMP Trap Host	Configuration change to an SNMP trap host.	-
`0x5000000000310004`	SNMP Engine ID	Configuration change to an SNMP engine ID.	-
`0x5000000000310005`	SNMP Ifindex Persistence	Configuration change to SNMP ifIndex persistence settings.	-
`0x5000000000310006`	SNMP Command	Configuration change to an SNMP command.	-
`0x5000000000320000`	Monitor	Configuration change to monitoring settings.	-
`0x5000000000320004`	Monitor Destination	Configuration change to a monitoring destination.	-
`0x5000000000320006`	Monitor Source	Configuration change to a monitoring source.	-
`0x5000000000330000`	Serial Port	Configuration change to a serial port.	-
`0x5000000000340000`	Serial Port App	Configuration change to a serial port application.	-
`0x5000000000350000`	GPS	Configuration change related to GPS settings.	-
`0x5000000000360000`	HSR/PRP	Configuration change related to HSR (High-availability Seamless Redundancy) or PRP (Parallel Redundancy Protocol) settings.	-
`0x5000000000360001`	HSR/PRP Statistics	Configuration change to HSR/PRP statistics settings.	-
`0x5000000000360002`	HSR/PRP Port	Configuration change to an HSR/PRP port.	-
`0x5000000000360003`	HSR/PRP Pairing	Configuration change to HSR/PRP port pairing.	-
`0x5000000000370000`	Multicast DNS	Configuration change related to mDNS (Multicast DNS) settings.	-
`0x5000000000380000`	VRF	Configuration change related to VRF (Virtual Routing and Forwarding) settings.	-
`0x5000000000390001`	MPTCP	Configuration change related to MPTCP (Multipath TCP) settings.	-
`0x50000000003a0000`	Profinet	Configuration change related to Profinet protocol settings.	-
`0x50000000003b0000`	DHCP Relay	Configuration change related to DHCP relay settings.	-
`0x50000000003b0001`	DHCP Relay Interface	Configuration change to a DHCP relay interface.	-
`0x50000000003b0002`	DHCP Relay Server	Configuration change to a DHCP relay server.	-
`0x50000000003b0003`	DHCP Relay Option 82	Configuration change to DHCP relay Option 82 settings.	-
`0x50000000003b0004`	DHCP Relay Port	Configuration change to a DHCP relay port.	-
`0x50000000003c0000`	CLI	Configuration change related to CLI (Command Line Interface) settings.	-
`0x50000000003d0000`	SSDP	Configuration change related to SSDP (Simple Service Discovery Protocol) settings.	-
`0x50000000003e0000`	Metrics	Configuration change to system metrics or monitoring settings.	-
`0x50000000003f0000`	Port Access DOT1X	Configuration change related to IEEE 802.1X authentication settings.	-
`0x50000000003f0001`	Port Access MAC auth	Configuration change to MAC-based authentication settings.	-
`0x50000000003f0002`	Port Access	Configuration change to port access control settings.	-
`0x50000000003f0003`	Port Access VLAN Assignment	Port Access VLAN Assignment.	-
`0x5000000000400000`	FDB	Configuration change to the forwarding database (FDB).	-
`0x5000000000400001`	FDB MAC	Configuration change to a MAC address in the forwarding database.	-
`0x5000000000400002`	FDB Group	Configuration change to a group in the forwarding database.	-
`0x5000000000410000`	RNRP	Configuration change related to RNRP (Redundant Network Ring Protocol) settings.	-
`0x5000000000410001`	RNRP Explicit	Configuration change to explicit RNRP settings.	-
`0x5000000000420000`	Vendor	Configuration change to vendor-specific settings.	-
`0x5000000000430000`	Policy	Configuration change to a policy or policy list.	-
`0x5000000000430001`	Policy Network	Configuration change to a policy network object.	-
`0x5000000000430002`	Policy Rule	Configuration change to a policy rule.	-
`0x5000000000430003`	Policy Port	Configuration change to a policy port.	-
`0x5000000000440000`	AT Command	Configuration change to an AT command.	-
`0x5000000000440001`	AT Map	Configuration change to an AT command map.	-
`0x5000000000440002`	AT Message	Configuration change to an AT command message.	-
`0x5000000000440003`	AT User Message	Configuration change to an AT user message.	-
`0x5000000000450000`	Logging	Configuration change to logging settings.	-
`0x5000000000450001`	Logging Source	Configuration change to a logging source.	-
`0x5000000000450002`	Logging Destination	Configuration change to a logging destination.	-
`0x5000000000450003`	Logging Filter	Configuration change to a logging filter.	-
`0x5000000000450004`	Logging Sink	Configuration change to a logging sink.	-
`0x5000000000460000`	TRDP	Configuration change related to TRDP (Train Real-time Data Protocol) settings.	-
`0x5000000000470000`	Router	Configuration change to router settings.	-
`0x5000000000480000`	RiCh	Configuration change related to RiCh (Ring Channel) settings.	-
`0x5000000000490000`	Factory Reset	Configuration change to factory reset settings or operation.	-
`0x5000000000500000`	Encrypted Secrets	Configuration change to encrypted secrets or secret management.	-
`0x5000000000510000`	Provisioning	Configuration change related to system provisioning.	-
`0x5000000000520000`	PKI	Configuration change related to PKI (Public Key Infrastructure) settings.	-
`0x5000000000520001`	PKI Server Status	Configuration change to PKI server status.	-
`0x5000000000520002`	PKI Enroll Server	Configuration change to PKI enrollment server settings.	-
`0x5000000000520003`	PKI Revocation	Configuration change to PKI certificate revocation settings.	-
`0x5000000000530000`	Bootloader Configuration	Bootloader Configuration.	-
`0x5000000000540000`	WireGuard	WireGuard.	-

Table 6: Configuration Change Events

These Event IDs are generated to account for any configuration change made to any configurable setting in the system. All events under the cluster 0x5000xxxxxxxxxxxx provide a comprehensive record of configuration changes to any configurable setting in the system.

Referring to the list of auditable Event IDs, various configuration change events can be generated. Instead of having a unique Event ID for every single configuration setting, they are categorised based on the type of setting changed. For example, there are unique Event IDs for changes made to system, interfaces, ports, VLANs, DHCP-Server, etc.

As an example of a configuration change event, consider that we change a few settings under the system configuration, like this:

example:/#> configure
example:/config/#> system
example:/config/system/#> hostname MySwitch
example:/config/system/#> location My Location
example:/config/system/#> contact My Contact
example:/config/system/#> leave
MySwitch:/#>

This should new generate three different audit log entries, with the Event ID representing configuration changes for system, which would be 0x5000000000080000. Therefore, the generated audit log entries would look something like this:

MySwitch:/#> audit
MySwitch:/audit/#> show
╒ Audit log ring buffer, entries 1-3 of 142 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                           │
│209  2025-03-10  Notice          admin          Configuration C...  system: "contact": from 'my       │
│     12:18:44    Security        administrator  System              previous' -> 'My Contact'         │
│                                                0x5000000000080000                                    │
├──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│208  2025-03-10  Notice          admin          Configuration C...  system: "location": from 'other   │
│     12:18:44    Security        administrator  System              location' -> 'My Location'        │
│                                                0x5000000000080000                                    │
├──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│207  2025-03-10  Notice          admin          Configuration C...  system: "hostname": from          │
│     12:18:44    Security        administrator  System              'example' -> 'MySwitch'           │
│                                                0x5000000000080000                                    │
└──────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 48 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

MySwitch:/#>

As we can see they all share the same Event ID, but the message indicates the specific values that were changed. In this case we can see that we changed "contact", "location", and "hostname" settings under the system configuration.

Configuration Transaction Events

The following Event IDs are available for the Configuration Transaction category:

Event ID	Event Name	Description	Note
`0x5100000000010000`	Start	Configuration transaction started.	-
`0x5100000000010001`	Start - Error	Error occurred while starting configuration transaction.	-
`0x5100000000020000`	End	Configuration transaction ended.	-
`0x5100000000020001`	End - Validation Fail	Configuration transaction ended with validation failure.	-
`0x5100000000020002`	End - Unchanged	Configuration transaction ended with no changes applied.	-
`0x5100000000020003`	Activation	Configuration transaction activated changes.	-
`0x5100000000020004`	End - Error	Error occurred while ending configuration transaction.	-
`0x5100000000030000`	Abort	Configuration transaction aborted.	-
`0x5100000000040000`	Lock	Configuration transaction lock acquired.	-
`0x5100000000050001`	Unlock	Configuration transaction lock released.	-
`0x5100000000060002`	Unlock - Error	Error occurred while releasing configuration transaction lock.	-

Table 7: Configuration Transaction Events

Audit Log Events

The following Event IDs are available for the Audit Log Event category:

Event ID	Event Name	Description	Note
`0x6000000000010000`	Display	The audit log was displayed or viewed via CLI command.	-
`0x6000000000010001`	Display Category	Audit log entries were displayed filtered by a specific category.	-
`0x6000000000020000`	Clear Ring Buffer	The internal audit log ring buffer was cleared, removing all stored audit events.	-
`0x6000000000030000`	Reload wauditd	The audit daemon (wauditd) was reloaded to apply configuration changes.	-
`0x6000000000040000`	Export	Audit log entries were exported to an external file or destination.	-
`0x6000000000050000`	Search	A search operation was performed on the audit log using pattern matching or regex.	-
`0x6000000000060000`	Time Search	A time-based search was performed on the audit log to find entries within a specific time range.	-
`0x6000000000070000`	Display from Web	The audit log was displayed or accessed via the web interface.	-
`0x6000000000080000`	Remote Shell Access Enabled	Remote shell access (e.g., SSH) was enabled on the system.	-
`0x6000000000080001`	Remote Shell Access changed from outside CLI	Remote shell access setting was modified from outside the CLI (e.g., via SSH or web interface).	-

Table 8: Audit Log Events

File System Events

The following Event IDs are available for the File System Event category:

Event ID	Event Name	Description	Note
`0x7000000000010000`	Copy	A file or directory was copied in the file system.	-
`0x7000000000010001`	Copy error	An error occurred during a file or directory copy operation.	-
`0x7000000000020000`	View	File view operation performed (e.g., file was opened or read).	-
`0x7000000000020001`	View error	An error occurred while viewing or accessing a file or directory.	-
`0x7000000000020002`	View diff	A difference between files was viewed.	-
`0x7000000000030000`	Erase	A file or directory was erased or deleted from the file system.	-
`0x7000000000030001`	Erase error	An error occurred during a file or directory erase operation.	-
`0x7000000000040000`	List directory	A directory listing operation was performed.	-
`0x7000000000040001`	List directory error	An error occurred during a directory listing operation.	-
`0x7000000000050001`	CRL downloaded	A certificate revocation list (CRL) was downloaded to the device.	-
`0x7000000000050002`	Config file created	A PKI configuration file was created on the device.	-
`0x7000000000050003`	Certificate enrolled	A certificate was successfully enrolled using SCEP.	-
`0x7000000000050004`	Certificate renewed	A certificate was successfully renewed using SCEP.	-
`0x7000000000050005`	PKI artifact import operation	A PKI artifact was imported into the device.	-
`0x7000000000050006`	PKI artifact generate operation	A PKI artifact was generated on the device.	-
`0x7000000000050007`	PKI artifact remove operation	A PKI artifact was removed from the device.	-
`0x7000000000050008`	Certificate enrollment failed.	A certificate enrollment operation failed.	-
`0x7000000000050009`	Certificate renewal failed.	A certificate renewal operation failed.	-
`0x700000000005000a`	PKI artifact import operation Fail	PKI artifact import operation failed.	-
`0x7000000000060000`	File Transfer Import	File transfer import operation performed.	-
`0x7000000000060001`	File Transfer Import Fail	File transfer import operation failed.	-
`0x7000000000060002`	File Transfer Export	File transfer export operation performed.	-
`0x7000000000060003`	File Transfer Export Fail	File transfer export operation failed.	-
`0x7000000000070000`	Upgrade Image Download	Upgrade image download operation performed.	-
`0x7000000000070001`	Upgrade Image Download Fail	Upgrade image download operation failed.	-
`0x7000000000080000`	Package File Download	Package file download operation performed.	-
`0x7000000000080001`	Package File Download Fail	Package file download operation failed.	-
`0x7000000000090000`	Unlock License File Import	Unlock License file import operation performed.	-
`0x7000000000090001`	Unlock License File Import Fail	Unlock License file import operation failed.	-
`0x70000000000a0000`	App Image Import	App Image Import.	-
`0x70000000000a0001`	App Image Import Fail	App Image Import Fail.	-

Table 9: File System Events

Configuration Integrity Events

The following Event IDs are available for the Configuration Integrity Event category:

Event ID	Event Name	Description	Note
`0x8000000000010000`	Integrity Alert	Configuration file integrity verification failed. For instance, file hash does not match stored hash, or no fingerprint exists for the file.	-
`0x8000000000020000`	Integrity OK	Configuration file integrity verification successful. File hash matches stored hash.	-
`0x8000000000030000`	Integrity Warning	Configuration file integrity warning. For instance, hash not found in integrity database or failed to erase fingerprint.	-
`0x8000000000040000`	Update Integrity	Configuration file hash updated in the integrity database.	-
`0x8000000000050000`	Add to Integrity DB	Configuration file fingerprint added to the integrity database for tracking.	-
`0x8000000000060001`	CSTINFO file upload: validation successful	CSTINFO data file uploaded and passed correctness validation (syntax and semantic rules).	-
`0x8000000000060002`	CSTINFO file upload: validation failed, syntax error	CSTINFO data file upload failed: syntax validation error.	-
`0x8000000000060003`	CSTINFO file upload: validation failed, semantic error	CSTINFO data file upload failed: semantic correctness rules violation.	-
`0x8000000000060004`	CSTINFO file missing - ECSP services limited	CSTINFO data file not found at startup; ECSP services are limited.	-
`0x8000000000060005`	CSTINFO file syntax error - ECSP services limited	CSTINFO data file failed syntax validation at startup; ECSP services are limited.	-
`0x8000000000060006`	CSTINFO file semantic error - ECSP services limited	CSTINFO data file failed semantic correctness validation at startup; ECSP services are limited.	-
`0x8000000000060007`	CSTINFO file hash not stored - contents may be unreliable	CSTINFO data file hash not found in configuration; file integrity cannot be verified.	-
`0x8000000000060008`	CSTINFO file hash mismatch - contents may be unreliable	CSTINFO data file hash differs from stored value; file may have been modified unintentionally.	-
`0x8000000000060009`	CSTINFO file hash validation successful	CSTINFO data file passed all validation checks (correctness and integrity).	-
`0x8000000000070000`	Custom Telegram Dataset File Ok	Custom TRDP telegram dataset file passed all validation checks (correctness and integrity).	-
`0x8000000000070001`	Custom Telegram Dataset File Missing	Custom TRDP telegram dataset file not found; custom telegrams are disabled.	-
`0x8000000000070002`	Custom Telegram Dataset File Error	Custom TRDP telegram dataset file failed validation (syntax or semantic error); custom telegrams are disabled.	-
`0x8000000000070003`	Custom Telegram Dataset File Hash Mismatch	Custom TRDP telegram dataset file hash differs from stored value; file may have been modified unintentionally.	-
`0x8000000000070004`	Custom Telegram Dataset File Hash Accepted	Custom TRDP telegram dataset file hash accepted by operator after validation.	-

Table 10: Configuration Integrity Events

Boot Process Events

The following Event IDs are available for the Boot Process Event category:

Event ID	Event Name	Description	Note
`0x9000000000010000`	Boot Loader Configuration Integrity	Boot Loader Configuration Integrity verification status.	-
`0x9000000000010010`	ID-mem Integrity	ID-mem Integrity verification status. Note: The ID-mem integrity verification should not fail during operation. If it does, this may indicate that the product definition of the product has been manipulated.	-

Table 11: Boot Process Events

Syslog Message Format for Auditable Events

For each audit event, a syslog message is by default generated and sent to the any configured logging destinations. For the audit events, the syslog message is formatted as follows:

type="audit"; eventid=<EVENTID>; username=<USERNAME>; userid=<USERID>; userrole=<ROLE>; seqnum=<NUM>; eventidtext="<EVENT_TEXT>"; msg="<MESSAGE>";

The different fields are constructed so that they should be easily parsable. The fields are as follows:

Field	Description
`type`	The type of the message, in this case `audit`, and it will always be `audit` for audit events.
`eventid`	The unique event ID for the audit event, where `<EVENTID>` is the hexadecimal representation of the event ID.
`username`	The username of the user that generated the audit event. Where `<USERNAME>` is the username of the user.
`userid`	The user ID of the user that generated the audit event. Where `<USERID>` is the user ID of the user, as an integer.
`userrole`	The role of the user that generated the audit event. Where `<ROLE>` is the role of the user.
`seqnum`	The sequence number of the audit event. Where `<NUM>` is the sequence number of the event, as an integer.
`eventidtext`	The text representation of the event ID. Where `<EVENT_TEXT>` is the text representation of the event ID and category.
`msg`	A message that provides additional information about the audit event. Where `<MESSAGE>` is the specific message for the event.

Example of an actual syslog message generated for an audit event, in this case a Link Up event:

type="audit"; eventid=0x3000000000020001; username=root; userid=0; userrole=system; seqnum=57; eventidtext="Control System Event - Link Up"; msg="port/interface ethX8";

Note on the Syslog Message Format

This is simply the message part of the syslog message, the header part is not included here. For information on the full syslog message format, please refer to the Logging documentation.

Sending Auditable Events With Syslog

When setting up logging on the device, one aspect is to specify the source of the log messages. When wanting to send log messages that originate from the device a source of type local is configured. In turn, this type can select a number of different local sources, one of them being audit. Therefore, when this local source type is selected, only log messages that fall within these auditable events will be sent to the configured logging destinations.

For more information on setting up logging sources, please refer to the Logging documentation.

If for some reason the syslog messages should not be generated for the auditable events, this can be configured in the CLI. Again, the auditable events will still be generated (unless they too are disabled), but they will not be sent to syslog, they will be stored in the local audit log ring buffer on the device.

Configuration

Configuration options related Audit can be found in the top-level configuration context in the CLI:

example:/#> configure
example:/config/#> audit
example:/config/audit/#>

[no] enable [CATEGORY]

Description

Enable or disable audit event logging

This setting controls whether audit events are logged or not. It is enabled or disabled on a per event category basis.

Default: Enabled, for all categories of audit events.

Example

Enable audit event logging for all categories:

example:/config/audit/#> enable

Disable audit event logging for all categories:

example:/config/audit/#> no enable

Enable audit event logging for a specific category:

example:/config/audit/#> enable access-control

Disable audit event logging for a specific category:

example:/config/audit/#> no enable access-control

Multiple categories can be enabled or disabled at the same time:

example:/config/audit/#> enable access-control request-error

Options

Option	Description
`no`	Disable audit event logging. If a specific category is provided, only that category will be disabled. If no category is provided, all categories will be disabled.
`CATEGORY`	Based on the list of available audit event categories, this is the category to enable or disable. If no category is provided, all categories will be enabled or disabled. TAB Completion When providing the category, tab completion can be used to list all available categories.

[no] syslog

Description

Enable or disable sending audit log messages to syslog

This setting controls whether audit events are sent to syslog or not.

note

Auditable event messages are always generated, if enabled, regardless of whether they are sent to syslog or not. On the device itself, they are stored separately from the syslog messages. If the auditable events are to be sent to a logging destination, this setting must be enabled.

Default: Enabled

Example

Enable sending audit log messages to syslog:

example:/config/audit/#> syslog

Disable sending audit log messages to syslog:

example:/config/audit/#> no syslog

Options

Option	Description
`no`	Disable sending audit log messages to syslog.

Operational Commands

Operational commands related to auditable events can be found in the audit context, located top-level exec context in the CLI:

example:/#> audit
example:/audit/#>

list [eventid | category]

Description

List the audit Categories and EventIDs that exist in the system.

This command will list all of the existing audit event categories and event IDs that can be available for the system.

Note on the Displayed Event IDs

This list shows every possible event ID and category that can be generated by the system. When these events can be generated is dependent on the configuration of the system.

Example

List all available audit event categories and event IDs:

example:/audit/#> list
...

Options

Option	Description
`eventid`	List only all available audit event IDs.
`category`	List only all available audit event categories.

[show] status

Description

Display basic status information about the internal audit ring buffer.

This command will display the current status of the internal audit ring buffer, including the number of entries currently stored in the buffer.

Example

Display the current status of the audit ring buffer:

example:/audit/#> status
AUDIT RING-BUFFER STATUS                                                      
Ring buffer count     : 72
Ring buffer used size : 5.41 KB
Ring buffer max size  : 1.00 MB

clear

Description

Clear the internal audit ring buffer.

This command will clear the internal audit ring buffer, removing all locally stored audit events.

Authorised Users Only

This command is only accessible by administrator level users.

Example

Clear the internal audit ring buffer:

example:/audit/#> clear
Are you sure you want to clear the audit log? (y/N) y
Clearing audit log...
example:/audit/#>

Viewing Auditable Events

Auditable events can be accessed and viewed in the CLI, from the audit context, accessed from the top level exec context:

example:/#> audit
example:/audit/#>

By default, when show commands are executed, the audit log will be attempted to be displayed in an interactive mode. This mode will display the audit log in a paginated format. If this is undesired, the entire terminal can be set to no interactive. Be aware that this will set no interactive mode for the entire CLI. Simply call interactive to re-enable the interactive mode.

Interactive Mode Over Console Connection

Be aware that by default when accessing the audit log though the CLI, the CLI will attempt to display the audit log in an interactive mode. Doing this over a console connection can be sluggish, as the output speed is limited by the baud rate of the connection.

Interactive Mode and Terminal Size

The interactive mode will attempt to display the audit log in a paginated format, based on the terminal size.

If the terminal size is not deemed large enough, the interactive mode will not be used, and the output will be displayed in a single page.

When displaying the audit log in interactive mode, the output will be displayed in a paginated format. The following commands can be used to navigate the output:

Command	Key	Description
Previous Page	`a`	Go to the previous page.
Next Page	`d`	Go to the next page.
Quit	`q`	Quit the pager. It should also be possible to exit the pager with `CTRL+C`. Simply pressing the enter key again will also exit the pager.
Refresh	`r`	Refresh the current page. This will also resize the terminal window.
Go to Page	`g`	Go to a specific page. You will be prompted to enter the page number.
List All	`l`	Display all entries at once. This will print all the entries and exit the pager.

Commands

show

Description

Display the entire internal audit ring buffer.

This command will display the entire internal audit ring buffer, showing all of the stored audit events.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entire audit ring buffer:

example:/audit/#> show
╒ Audit log ring buffer, entries 1-4 of 149 ═════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│216  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:14    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│215  2025-03-10  Info            root           Control System ...  interface vlan1 ip              │
│     12:42:57    Security        system         DHCP Client Lea...  198.18.1.101 mask 24 broadcast  │
│                                                0x3000000000050003  198.18.1.255 router 198.18.1.99 │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 38 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all
example:/#>

show last <NUMBER>

Description

Display the last NUMBER of entries in the internal audit ring buffer.

This command will display the last NUMBER of entries in the internal audit ring buffer.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the last 3 entries in the audit ring buffer:

example:/audit/#> show last 3
╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│216  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:14    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 1 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all
example:/#>

Options

Option	Description
`NUMBER`	The number of entries to display, provided as an integer.

show range <START> <NUM>

Description

Show a range of entries in the audit ring buffer.

The range is specified by a starting entry number START and the number of entries to display NUM, from the starting entry.

The START number is ordered from lowest to highest, with 0 being the latest entry in the ring buffer. Entries are displayed backwards from START, so if START is 0 and NUM is 5, you will see the five latest entries.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display 3 entries beginning from the 6th entry in the audit ring buffer:

example:/audit/#> show range 6 3
╒ Audit log ring buffer, entries 6-8 of 8 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:46    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 1 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all
example:/#>

Options

Option	Description
`START`	The starting entry number, provided as an integer. The starting entry is ordered from lowest to highest, with 0 being the latest entry in the ring buffer.
`NUM`	The number of entries to display, provided as an integer, from the starting entry.

show time [[YYYY-MM[-DD]] [hh:mm[:ss]]] [[YYYY-MM[-DD]] [hh:mm[:ss]]]

Description

Display the entries in the internal audit ring buffer within the specified time range.

This command will display the entries in the internal audit ring buffer that fall within the specified time range.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entries in the audit ring buffer that fall within the time range from 2025-03-10 12:48:30 to 2025-03-10 12:48:50:

example:/audit/#> show time 2025-03-10 12:48:30 2025-03-10 12:48:50
╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:46    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 1 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

Options

Option	Description
`YYYY`	The year, provided as an integer.
`MM`	The month, provided as an integer between 1 and 12.
`DD`	The day, provided as an integer between 1 and 31.
`hh`	The hour, provided as an integer between 0 and 23.
`mm`	The minute, provided as an integer between 0 and 59.
`ss`	The second, provided as an integer between 0 and 59.

show from [[YYYY-MM[-DD]] [hh:mm[:ss]]]

Description

Display the entries in the internal audit ring buffer from the specified time.

This command will display the entries in the internal audit ring buffer that have been generated with a timestamp that falls after the specified time.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entries in the audit ring buffer that have been generated from 2025-03-10 12:48:30:

example:/audit/#> show from 2025-03-10 12:48:30
╒ Audit log ring buffer, entries 9-12 of 12 ═════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│220  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:50:53    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:46    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 2 of 2 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

Options

Option	Description
`YYYY`	The year, provided as an integer.
`MM`	The month, provided as an integer between 1 and 12.
`DD`	The day, provided as an integer between 1 and 31.
`hh`	The hour, provided as an integer between 0 and 23.
`mm`	The minute, provided as an integer between 0 and 59.
`ss`	The second, provided as an integer between 0 and 59.

show to [[YYYY-MM[-DD]] [hh:mm[:ss]]]

Description

Display the entries in the internal audit ring buffer to the specified time.

This command will display the entries in the internal audit ring buffer that have been generated with a timestamp that falls before the specified time.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entries in the audit ring buffer that have been generated to 2025-03-10 12:48:50:

example:/audit/#> show to 2025-03-10 12:48:50
╒ Audit log ring buffer, entries 1-3 of 148 ═════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
│219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
│     12:48:46    Security        administrator  Display             from the CLI.                   │
│                                                0x6000000000010000                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
│     12:48:37    Auth            system         SSH login Success   user 'admin' from 198.18.1.99   │
│                                                0x1000000000010020                                  │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
│     12:48:34    Auth            system         SSH login Exit      'admin' from 198.18.1.99:33202  │
│                                                0x1000000000010021                                  │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 50 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

Options

Option	Description
`YYYY`	The year, provided as an integer.
`MM`	The month, provided as an integer between 1 and 12.
`DD`	The day, provided as an integer between 1 and 31.
`hh`	The hour, provided as an integer between 0 and 23.
`mm`	The minute, provided as an integer between 0 and 59.
`ss`	The second, provided as an integer between 0 and 59.

show search [case] "STRING"

Description

Display the entries in the internal audit ring buffer that contain the specified string.

This command will display the entries in the internal audit ring buffer that contain the specified string. The provided search string supports regular expressions. The search string will search based on the Event ID and the message of the audit event.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entries in the audit ring buffer that contain the string SSH login:

example:/audit/#> show search "SSH login"
╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE  EVENTID             MESSAGE                             │
│218  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
│     12:48:37    Auth            system     SSH login Success   'admin' from 198.18.1.99            │
│                                            0x1000000000010020                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root       Access Control      SSH login exit for user 'admin'     │
│     12:48:34    Auth            system     SSH login Exit      from 198.18.1.99:33202              │
│                                            0x1000000000010021                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│115  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
│     12:13:07    Auth            system     SSH login Success   'admin' from 198.18.1.99            │
│                                            0x1000000000010020                                      │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 1 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

Options

Option	Description
`case`	If the `case` argument is provided, the search will be case sensitive.
`"STRING"`	The string to search for, provided in double quotes. This is a free-form string that supports regular expressions.

show category CATEGORY

Description

Display the entries in the internal audit ring buffer that belong to the specified category.

This command will display the entries in the internal audit ring buffer that belong to the specified category.

Interactive Mode

The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

Example

Display the entries in the audit ring buffer that belong to the access-control category:

example:/audit/#> show category "access-control"
╒ Audit log ring buffer, entries 1-5 of 5 ═══════════════════════════════════════════════════════════╕
│SEQ  TIME        LEVEL/FACILITY  USER/ROLE  EVENTID             MESSAGE                             │
│218  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
│     12:48:37    Auth            system     SSH login Success   'admin' from 198.18.1.99            │
│                                            0x1000000000010020                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│217  2025-03-10  Notice          root       Access Control      SSH login exit for user 'admin'     │
│     12:48:34    Auth            system     SSH login Exit      from 198.18.1.99:33202              │
│                                            0x1000000000010021                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│115  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
│     12:13:07    Auth            system     SSH login Success   'admin' from 198.18.1.99            │
│                                            0x1000000000010020                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│111  2025-03-10  Notice          admin      Access Control      CLI Domain shell exited             │
│     12:12:51    Auth            admini...    Exit CLI Shell                                        │
│                                            0x1000000000030001                                      │
├────────────────────────────────────────────────────────────────────────────────────────────────────┤
│110  2025-03-10  Notice          admin      Access Control      CLI Domain shell accessed           │
│     12:12:50    Auth            admini...    Enter CLI Shell                                       │
│                                            0x1000000000030000                                      │
└────────────────────────────────────────────────────────────────────────────────────────────────────┘
Page 1 of 1 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

Options

Option	Description
`CATEGORY`	The category to display, based on the available categories. TAB Completion The available categories can be tab completed in the CLI.

show raw

Description

Display the raw audit log file.

This command will display the raw audit log file, showing all of the stored audit events. This is not displaying from the ring buffer storing the audit events, but from a local log file written with syslog. Therefore, the output in this file is how the audit messages would look also when sent to a remote syslog server.

Number of Entries

The number of entries that are stored in the raw audit log file is most likely going to be a lot less than what is stored in the internal audit ring buffer.

Example

Display the raw audit log file:

example:/audit/#> show raw
Mar 10 12:48:34 MySwitch wauditd[1624]: type="audit"; eventid=0x1000000000010021; username=root; userid=0; userrole=system; seqnum=217; eventidtext="Access Control - SSH login Exit"; msg="SSH login exit for user 'admin' from 198.18.1.99:33202";
Mar 10 12:48:37 MySwitch wauditd[1624]: type="audit"; eventid=0x1000000000010020; username=root; userid=0; userrole=system; seqnum=218; eventidtext="Access Control - SSH login Success"; msg="Authentication successful for user 'admin' from 198.18.1.99";
Mar 10 12:48:46 MySwitch wauditd[1624]: type="audit"; eventid=0x6000000000010000; username=admin; userid=500; userrole=administrator; seqnum=219; eventidtext="Audit Log Event - Display"; msg="Entire audit log displayed from the CLI.";

Introduction​

Overview​

Auditable Event Categories​

Auditable Event Types​

Access Control Events​

Request Error Events​

Control System Events​

Backup Restore Events​

Configuration Change Events​

Configuration Transaction Events​

Audit Log Events​

File System Events​

Configuration Integrity Events​

Boot Process Events​

Syslog Message Format for Auditable Events​

Configuration​

Description

Example​

Options

Description

Example​

Options

Operational Commands​

Description

Example​

Options

Description

Example​

Description

Example​

Viewing Auditable Events​

Viewing Entires in the Pager​

Commands​

Description

Example​

Description

Example​

Options

Description

Example​

Options

Description

Example​

Options

Description

Example​

Options

Description

Example​

Options

Description

Example​

Options

Description

Example​

Options

Description

Example​

Introduction

Overview

Auditable Event Categories

Auditable Event Types

Access Control Events

Request Error Events

Control System Events

Backup Restore Events

Configuration Change Events

Configuration Transaction Events

Audit Log Events

File System Events

Configuration Integrity Events

Boot Process Events

Syslog Message Format for Auditable Events

Configuration

Example

Example

Operational Commands

Example

Example

Example

Viewing Auditable Events

Viewing Entires in the Pager

Commands

Example

Example

Example

Example

Example

Example

Example

Example

Example