Reference (Supporting Fabric OS v7.3.0) Owner manual

60 Fabric OS Command Reference
53-1003131-01
auditDump
2
auditDump
Displays or clears the audit log.
SYNOPSIS auditdump -s | -show
auditdump -c | -clear
DESCRIPTION Use this command to display or clear the audit log on the switch. The audit log persistently saves the
most recent 256 log entries on the switch. On modular platforms, the entries are not shared across CPs.
Each CLI executed on a switch from non-root user account is saved as an audit log. To display or clear
the logs, this command must be issued for each CP separately.
NOTES The execution of this command is subject to Virtual Fabric or Admin Domain restrictions that may be in
place. Refer to Chapter 1, "Using Fabric OS Commands" and Appendix A, "Command Availability" for
details.
OPERANDS This command has the following operands:
-s | -show
Displays the audit log on the switch or the CP.
-c | -clear
Clears the audit log on the switch or the CP.
EXAMPLES To display the audit log:
switch:admin> auditdump -s
0 AUDIT, 2010/02/18-01:45:52 (PDT), [SEC-3022], INFO, SECURITY,
admin/admin/10.32.220.161/http/DCFM-HttpConnec, ad_0/ras035/FID
128,, Event: logout, Status: success, Info: Successful logout
by user [admin].
1 AUDIT, 2010/02/18-01:46:00 (PDT), [SEC-3022], INFO, SECURITY,
admin/admin/10.32.220.161/http/DCFM-HttpConnec, ad_0/ras035/FID
128,, Event: logout, Status: success, Info: Successful logout
by user [admin].
2 AUDIT, 2010/02/18-01:46:18 (PDT), [SEC-3020], INFO, SECURITY,
admin/admin/10.32.220.161/http/DCFM-HttpConnec, ad_0/ras035/FID
128,, Event: login, Status: success, Info: Successful login
attempt via HTTP, IP Addr: 10.32.220.161.
3 AUDIT,2012/05/23-03:45:15 (UTC),[RAS-3005], INFO, CLI,
admin/admin/NONE/console/CLI,ad_0/McKsSpirit/CHASSIS,
CLI:clihistory
4 AUDIT,2012/05/23-04:12:04 (UTC),[RAS-3005],INFO,CLI,
admin/admin/NONE/console/CLI,ad_0/McKsSpirit/CHASSIS,
CLI:auditdump -s
(output truncated)
To clear the audit log:
switch:admin> auditdump -c
SEE ALSO auditCfg