SSH Reference Manual

Event
Id
Event Name Conditions Pattern Token Values
%outcome: ‘granted’, ‘denied’ or
‘failed’
%forcedCommand: forced
command
19
ForwardEven
t
Direct
"%sessionId: %user@%remoteAddress
%action %object %outcome
(%fromAddr:%fromPort-
>%toAddr:%toPort)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘direct-tcpip’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%fromAdd: from address
%fromPort: from port
%toAdd: to address
%toPort: to port
Not Direct
"%sessionId: %user@%remoteAddress
%action %object %outcome
(%fromAddr:%fromPort->remote,
accepted on %toAddr:%toPort)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘forward-tcpip’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%fromAdd: from address
%fromPort: from port
%toAdd: to address
%toPort: to port
19 ListenEvent
"%sessionId: %user@%remoteAddress
%action %object %outcome (listen on:
%interface:%port)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘tcpip-forward’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%interface: local bind address
%port: local port
20
TimeoutEven
t
"%sessionId: %user@%remoteAddress
%action %object"
%sessionId: SESSION-LOG-ID
%remoteAddress: remote IP
address
%action: ‘idle timeout’
%object: module experiencing
timeout (currently always
‘SFTPSERV’)
21
SftpServerFa
talErrorEvent
“%sessionId: %user@%remoteAddress
%action %object error info: '%errInfo',
%processType process %processName
stopping..."
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
320 • Monitoring and Auditing HP NonStop SSH Reference Manual