SSH Reference Manual

Event
Id
Event Name Conditions Pattern Token Values
%outcome: ‘denied’ or ‘failed’
16 PtyEvent Successful
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘ptyallocate’
%object: pty name
%outcome: ‘granted’
Failed
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘ptyallocate’
%object: (empty)
%outcome: ‘denied’ or ‘failed’
17 ShellEvent
No forced
command
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘shell’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
Forced command
"%sessionId: %user@%remoteAddress
%action %object %outcome (forced
command: %forcedcommand)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘shell’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
%forcedCommand: forced
command
18 ExecEvent
No forced
command
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘exec’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
Forced command
"%sessionId: %sessionId:
%user@%remoteAddress %action %object
%outcome (forced command:
%forcedcommand)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘exec’
%object: shell program
HP NonStop SSH Reference Manual Monitoring and Auditing • 319