API Guide

show logging audit
Displays audit log entries.
Syntax
show logging audit [reverse] [number]
Parameters
● reverse — Display entries starting with the most recent events.
● number — Display the specified number of audit log entries users, from 1 to 65535.
Default Display 24 entries starting with the oldest events.
Command Mode EXEC
Usage
Information
Only the sysadmin and secadmin roles can display the audit log. Enter reverse to display entries
starting with the most recent events. You can change the number of entries displayed. Audit log records
do not display on the console as they occur. They are saved in the audit log and forwarded to any
configured Syslog servers.
Example
OS10# show logging audit 4
<14>1 2019-02-14T13:15:06.283337+00:00 OS10 audispd - - - Node.1-Unit.1:PRI [audit],
Dell EMC (OS10) node=OS10 type=USER_END msg=audit(1550150106.277:597): pid=7908 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="admin" exe="/bin/su"
hostname=? addr=? terminal=??? res=success'
<110>1 2019-02-14T13:15:16.331515+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'crypto security-profile mltestprofile' - success
<110>1 2019-02-14T13:15:21.794529+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:16:05.882555+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
OS10# show logging audit reverse 4
<110>1 2019-02-14T13:16:05.882555+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:15:21.794529+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:15:16.331515+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'crypto security-profile mltestprofile' - success
<14>1 2019-02-14T13:15:06.283337+00:00 OS10 audispd - - - Node.1-Unit.1:PRI [audit],
Dell EMC (OS10) node=OS10 type=USER_END msg=audit(1550150106.277:597): pid=7908 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="admin" exe="/bin/su"
hostname=? addr=? terminal=??? res=success'OS10# show logging audit reverse 10
Supported Releases
10.4.3.0 or later
logging audit enable
Enables recording of configuration and security event in the audit log.
Syntax
logging audit enable
Parameters None
Defaults Not configured
Command Mode CONFIGURATION
Usage
Information
Audit log entries are saved locally and sent to configured Syslog servers. Only the sysadmin and
secadmin roles can enable the audit log. The no version of the command disables audit log recording.
Example
OS10(conf)# logging audit enable
Supported
Releases
10.4.3.0 or later
Security 1053