HP XP P9000 Audit Log User and Reference Guide

Table 5 Items in the Syslog File (continued)
DescriptionItemNo.
The serial number of the syslog header information.Message identification7
No output8
The date, time and the time difference between UTC in the format of
"YYYY-MM-DD-Thh:mm:ss.s ± hh:mm."
Date, time#2*9
• YYYY: year, MM: month, DD: day.
• hh: hour, mm: minute, ss.s: second in one decimal place.
• ± hh:mm: hours and minute of the time difference. "Z" is displayed instead of "±
hh:mm" when there is no time difference between UTC, such as
"2005-12-26T:23:06:58.0Z."
The detection entity identification character (Storage).Detection entity10
The host name (SVP).Detected location11
The category name of the event.Type of audit event12
• StartStop indicates the start or stop of the operating system on the SVP or the
storage system. It also indicates the start or stop of hardware and software.
• Failure indicates failures in hardware and software.
• LinkStatus indicates link-up or link-down of ports.
• ExternalCommunication indicates communications with other external services.
• Authentication of RMI, FC-SP, or Remote Web Console.
• AcceessControl indicates success or failure in accessing resources.
• ContentAccess indicates success or failure in accessing files.
• ConfigurationAccess indicates setting from Remote Web Console, SVP, host,
computer using RAID Manager, Business Continuity Manager, or HTS Manager.
• AnomalyEvent indicates reached the maximum of the Audit Log, etc.
• Maintenance indicates SVP operations.
• ExternalService indicates remote maintenance operations via SVP.
Result of audit event13
• Success: Normal end. The operation has ended normally.
• Failed: Error (xxxx-yyyy). The operation has ended abnormally.
• Failed: Warning (xxxx-yyyy). The operation has partly ended abnormally or was
canceled during the operation.
"xxxx-yyyyy" indicates error codes and it is output only for Remote Web Console
operations.
The user name in the format of “uid=user name.”Subject identification14
• <system> is output when the category name is "AnomalyEvent" or the encryption
key is created.
• <DKCMaintenance> is output for SVP operations.
• <Host> is output for commands from host.
The ID (R700) to identify the model name of the product and the serial number divided
by a colon.
Hardware identification15
No outputGenerated location16
The location identification name set by the user in the Syslog window.Related information17
No output.18
No output.19
No output.Agent information20
Syslog file format 21