Fabric OS Administrator's Guide v7.0.0 (53-1002148-02, June 2011)

60 Fabric OS Administrator’s Guide

53-1002148-02

Audit log configuration

4. Enter the auditCfg --show command to view the filter configuration and confirm that the

correct event classes are being audited, and the correct filter state appears (enabled or

disabled).

switch:admin> auditcfg --show

Audit filter is enabled.

2-SECURITY

4-FIRMWARE

5. Issue the auditDump -s command to confirm that the audit messages are being generated.

Example of the SYSLOG (system message log) output for audit logging

Oct 10 08:52:06 10.3.220.7 raslogd: AUDIT, 2008/10/10-08:20:19 (GMT),

[SEC-3020], INFO, SECURITY, admin/admin/10.3.220.13/telnet/CLI,

ad_0/ras007/FID 128, , Event: login, Status: success, Info: Successful login

attempt via REMOTE, IP Addr: 10.3.220.13.

Oct 10 08:52:23 10.3.220.7 raslogd: 2008/10/10-08:20:36, [CONF-1001], 13, WWN

10:00:00:05:1e:34:02:0c | FID 128, INFO, ras007, configUpload completed

successfully. All config parameters are uploaded.

Oct 10 09:00:04 10.3.220.7 raslogd: AUDIT, 2008/10/10-08:28:16 (GMT),

[SEC-3021], INFO, SECURITY, admin/NONE/10.3.220.13/None/CLI, None/ras007/FID

128, , Event: login, Status: failed, Info: Failed login attempt via REMOTE, IP

Addr: 10.3.220.13.