WeOS
5.29.0

# Auditable Events

## Introduction

This document provides a overview of auditable events within the system. Auditable events are categorised into different groups based on the type of event, making it easier to manage and understand the events. Each individual event that is produced by the system is represented by a unique Event ID.

Auditable events play a crucial role in maintaining the security and integrity of the system. They provide a detailed record of significant actions and changes, which can be used for various purposes, including:

- Security Monitoring: Tracking login attempts, configuration changes, and other critical actions to detect and respond to potential security threats.
- Compliance: Ensuring that the system adheres to regulatory requirements by maintaining a detailed audit trail of all significant events.
- Troubleshooting: Providing a historical record of events that can be used to diagnose and resolve issues within the system.
- Accounting: Keeping track of user activities and system changes to ensure accountability and transparency.

This document also details the format of syslog messages generated for audit events, the configuration options available for managing audit event logging, and the operational commands for viewing and managing the audit log.

Related Examples and Use-Cases

- Logging
- Transmitting Auditable Events to Remote Machines HowTo

## Overview

### Auditable Event Categories

The auditable events are categorised into different categories, based on the type of the event. The categories are used to group the events into logical groups, making it easier to manage and understand the events. Each individual Event ID will always be associated with a specific category, based on how the Event ID is constructed.

The entire Event ID is a 64-bit value, where the upper 16 bits are used to specify the category of the event, and the lower 48 bits are used to specify the specific event within that category. The following categories are available:

Category ID | Category Name | Description
--- | --- | ---
`0x1000` | Access Control | Events related to access control, such as login, logout, authentication, etc.
`0x2000` | Request Error | Events related to errors in requests, such as invalid requests, unauthorized requests, etc.
`0x3000` | Control System Event | Events related to the control system, such as link up, link down, system reboot, etc.
`0x4000` | Backup Restore Event | Events related to backup and restore operations, such as storing of configuration, etc.
`0x5000` | Configuration Change | Events related to configuration changes, such as specific configuration changes to the system.
`0x5100` | Configuration Transaction | Events related to configuration transactions, such as configuration commit, rollback, etc.
`0x6000` | Audit Log Event | Events related to the audit log, such as audit log display, audit log clear, etc.
`0x7000` | File System Event | Events related to the file system, such as file creation, deletion, modification, etc.
`0x8000` | Configuration Integrity | Events related to configuration integrity, such as configuration integrity check, etc.
`0x9000` | Boot Process Event | Events related to the boot process

Table 1: Auditable Event Categories

Possibly Subject to Change

Since this is a very new addition to the system, it is possible that changes will be made to the Categories in the upcoming releases. The intention is to keep the Categories as stable as possible, but because more changes may be needed early on, it is possible that they will be changed.

### Auditable Event Types

Each auditable event is represented by a unique Event ID. The Event ID is a 64-bit value, where the upper 16 bits are used to specify the category of the event, and the lower 48 bits are used to specify the specific event within that category.

The Event ID is constructed in the following manner:

    +-----------------+-----------------+-----------------+
    | Category        | Main ID         | Sub ID          |
    +-----------------+-----------------+-----------------+
    | 0xffff          | 0xffffffff      | 0xffff          |
    +-----------------+-----------------+-----------------+

As can be seen, the Event ID is divided into three parts:

- Category: The upper 16 bits are used to specify the category of the event. This is the exact values defined in the Auditable Event Categories section. Therefore, no Event ID can exist that does not have a valid category, i.e. the initial part of the Event ID will always be a valid category. Therefore, it is always possible to determine the category of an Event ID by looking at the upper 16 bits.

- Main ID: The next 32 bits are used to specify the main ID of the event.

- Sub ID: The lower 16 bits are used to specify the sub ID of the event. This can be used to further specify an event that is part of a larger category.

As an example, if we take the following Event ID `0x1000000000010010` which represents a successful console login event, we can break it down as follows:

- Category: `0x1000` which corresponds to the Access Control category.
- Main ID: `0x00000001` which is the main ID of the event.
- Sub ID: `0x0010` which is the sub ID of the event.

Possibly Subject to Change

Since this is a very new addition to the system, it is possible that changes will be made to the Event IDs in the upcoming releases. The intention is to keep the Event IDs as stable as possible, but because more changes may be needed early on, it is possible that they will be changed.

However, if changes are made to existing events in the future, the aim is to retire any existing Event IDs, so that they will not be reused for new events. This way, the Event IDs will always be unique, and will not be reused for different events.

#### Access Control Events

The following Event IDs are available for the Access Control category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x1000000000010010` | Console login Success | Successful console login event. | -
`0x1000000000010011` | Console login Exit | Console login session ended. | -
`0x1000000000010012` | Console login Failure | Failed console login attempt. | -
`0x1000000000010013` | Suspicious Console login Success | Console login succeeded with suspicious credentials or context. | -
`0x1000000000010014` | Suspicious Console login Failure | Failed console login attempt flagged as suspicious. | -
`0x1000000000010015` | Console login Success secureTTY | Successful console login via secure TTY (trusted terminal). | -
`0x1000000000010020` | SSH login Success | Successful SSH login event. | -
`0x1000000000010021` | SSH login Exit | SSH login session ended. | -
`0x1000000000010022` | SSH login Failure | Failed SSH login attempt. | -
`0x1000000000010023` | Suspicious SSH login Success | SSH login succeeded with suspicious credentials or context. | -
`0x1000000000010024` | Suspicious SSH login Failure | Failed SSH login attempt flagged as suspicious. | -
`0x1000000000010030` | Web login Success | Successful web interface login event. | -
`0x1000000000010031` | Web login Exit | Web login session ended. | -
`0x1000000000010032` | Web login Failure | Failed web login attempt. | -
`0x1000000000010033` | Suspicious Web login Success | Web login succeeded with suspicious credentials or context. | -
`0x1000000000010034` | Suspicious Web login Failure | Failed web login attempt flagged as suspicious. | -
`0x1000000000010040` | Telnet login Success | Successful Telnet login event. | -
`0x1000000000010041` | Telnet login Exit | Telnet login session ended. | -
`0x1000000000010042` | Telnet login Failure | Failed Telnet login attempt. | -
`0x1000000000010043` | Suspicious Telnet login Success | Telnet login succeeded with suspicious credentials or context. | -
`0x1000000000010044` | Suspicious Telnet login Failure | Failed Telnet login attempt flagged as suspicious. | -
`0x1000000000010050` | Other login Success | Successful login via other (non-standard) method. | -
`0x1000000000010051` | Other login Exit | Other login session ended. | -
`0x1000000000010052` | Other login Failure | Failed login attempt via other method. | -
`0x1000000000010053` | Suspicious Other login Success | Other login succeeded with suspicious credentials or context. | -
`0x1000000000010054` | Suspicious Other login Failure | Failed other login attempt flagged as suspicious. | -
`0x1000000000020000` | SNMPv3 Access Success | Successful SNMPv3 access. | -
`0x1000000000020001` | SNMPv3 Access Failure | Failed SNMPv3 access attempt. | -
`0x1000000000020002` | SNMPv3 Engine ID Failure | SNMPv3 engine ID verification failed. | -
`0x1000000000020003` | SNMPv2 Access Success | Successful SNMPv2 access. | -
`0x1000000000020004` | SNMPv2 Access Failure | Failed SNMPv2 access attempt. | -
`0x1000000000020005` | SNMP Command Success | SNMP command executed successfully. | -
`0x1000000000020006` | SNMP Command Failure | SNMP command execution failed. | -
`0x1000000000030000` | Enter CLI Shell | Entered CLI shell session. | -
`0x1000000000030001` | Exit CLI Shell | Exited CLI shell session. | -
`0x1000000000040001` | Authorised MAC address through mac-authentication | MAC address authorised via MAC authentication . | Deprecated
`0x1000000000040002` | De-authorised MAC address through mac-authentication | MAC address de-authorised via MAC authentication . | Deprecated
`0x1000000000040003` | Authentication through mac-authentication failed | MAC authentication attempt failed . | Deprecated
`0x1000000000040008` | Authorised MAC address through MAB | Authorised MAC address through MAB. | -
`0x1000000000040009` | De-authorised MAC address through MAB | De-authorised MAC address through MAB. | -
`0x100000000004000A` | Authentication through MAB failed | Authentication through MAB failed. | -
`0x100000000004000B` | Assign port to VID from radius server through MAB | Assign port to VID from radius server through MAB. | -
`0x100000000004000C` | Assign port to VID from ports default through MAB | Assign port to VID from ports default through MAB. | -
`0x100000000004000D` | Assign port to start VID, nothing authenticated through MAB | Assign port to start VID, nothing authenticated through MAB. | -
`0x100000000004000E` | No allowed VID provided in radius server response for MAB | No allowed VID provided in radius server response for MAB. | -
`0x100000000004000F` | Default VLAN disabled for MAB | Default VLAN disabled for MAB. | -
`0x1000000000040010` | Port is already assigned to a different VID, cannot be assigned by MAB | Port is already assigned to a different VID, cannot be assigned by MAB. | -
`0x1000000000040011` | Port unlocked MAB Port Mode | Port unlocked MAB Port Mode. | -
`0x1000000000040012` | Port locked MAB Port Mode | Port locked MAB Port Mode. | -
`0x1000000000040013` | Authorised MAC address through MAC Whitelist | Authorised MAC address through MAC Whitelist. | -
`0x1000000000040014` | De-authorised MAC address through MAC Whitelist | De-authorised MAC address through MAC Whitelist. | -
`0x1000000000040015` | Authentication through MAC Whitelist failed | Authentication through MAC Whitelist failed. | -
`0x1000000000040016` | Port unlocked MAC Whitelist Port Mode | Port unlocked MAC Whitelist Port Mode. | -
`0x1000000000040017` | Port locked MAC Whitelist Port Mode | Port locked MAC Whitelist Port Mode. | -
`0x1000000000040004` | Authorised MAC address through 802.1X | MAC address authorised via IEEE 802.1X authentication . | Deprecated
`0x1000000000040005` | De-authorised MAC address through 802.1X | MAC address de-authorised via IEEE 802.1X authentication . | Deprecated
`0x1000000000040006` | Authentication through 802.1X failed | IEEE 802.1X authentication failed . | Deprecated
`0x1000000000040007` | IPsec Authentication failed | IPsec Authentication failed . | Deprecated
`0x1000000000050001` | Authorised MAC address through 802.1X | MAC address authorised via IEEE 802.1X authentication. | -
`0x1000000000050002` | De-authorised MAC address through 802.1X | MAC address de-authorised via IEEE 802.1X authentication. | -
`0x1000000000050003` | Authentication through 802.1X failed | IEEE 802.1X authentication failed. | -
`0x1000000000050004` | Assign port to VID from radius server through 802.1X | Assign port to VID from radius server through 802.1X. | -
`0x1000000000050005` | Assign port to VID from ports default through 802.1X | Assign port to VID from ports default through 802.1X. | -
`0x1000000000050006` | Assign port to start VID, nothing authenticated through 802.1X | Assign port to start VID, nothing authenticated through 802.1X. | -
`0x1000000000050007` | No allowed VID provided in radius server response for 802.1X | No allowed VID provided in radius server response for 802.1X. | -
`0x1000000000050008` | Default VLAN disabled for 802.1X | Default VLAN disabled for 802.1X. | -
`0x1000000000050009` | Port is already assigned to a different VID, cannot be assigned by 802.1X | Port is already assigned to a different VID, cannot be assigned by 802.1X. | -
`0x1000000000050010` | Port unlocked 802.1X Port Mode | Port unlocked 802.1X Port Mode. | -
`0x1000000000050011` | Port locked 802.1X Port Mode | Port locked 802.1X Port Mode. | -
`0x1000000000060001` | IPsec Authentication failed | IPsec Authentication failed. | -

Table 2: Access Control Events

#### Request Error Events

The following Event IDs are available for the Request Error category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x2000000000010000` | Unauthorised CLI Command | Attempt to execute a CLI command without proper authorisation. | -
`0x2000000000020000` | SNMP OID Request Success | SNMP OID request completed successfully. | -
`0x2000000000020001` | SNMP OID Request Failure | SNMP OID request failed (e.g., due to permissions or bad OID). | -
`0x2000000000030000` | Unauthorised SSH User | SSH login attempt by unauthorised user. | -
`0x2000000000030001` | Unauthorised Web User | Web login attempt by unauthorised user. | -
`0x2000000000030002` | Unauthorised Console User | Console login attempt by unauthorised user. | -

Table 3: Request Error Events

#### Control System Events

The following Event IDs are available for the Control System Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x3000000000010001` | Service Start | A system service has started. | -
`0x3000000000010002` | Service Stop | A system service has stopped. Some services will also be stopped and started as part of their restart handling. | -
`0x3000000000010003` | Service Restart | A system service has restarted. Typically this can occur during system reconfiguration. | -
`0x3000000000010004` | Service Died | A system service has unexpectedly terminated. The system will attempt to restart it. | -
`0x3000000000010005` | Service Crash | A system service has crashed. It has died too many times within a short period and attempts to restart it will cease, it is now considered crashed. | -
`0x3000000000010006` | Service Crash Restart | A system service crashed and was automatically restarted. | -
`0x3000000000020001` | Link Up | A network link became active. | -
`0x3000000000020002` | Link Down | A network link became inactive. | -
`0x3000000000030001` | System Boot | The system has booted. | -
`0x3000000000030002` | System Startup | The system startup process has completed. | -
`0x3000000000030003` | System Operational | The system is now operational. | -
`0x3000000000030004` | System Shutdown | The system is shutting down. | -
`0x3000000000030005` | System Upgrade | A system upgrade has occurred. | -
`0x3000000000030006` | System Upgrade Failed | System Upgrade Failed. | -
`0x3000000000030007` | System Upgrade Validation Passed | System Upgrade Validation Passed. | -
`0x3000000000030008` | System Upgrade Validation Failed | System Upgrade Validation Failed. | -
`0x3000000000040000` | ECSC Communication Established | ECSC communication channel established. | -
`0x3000000000040001` | TTDP Stack Ready | TTDP protocol stack is ready. | -
`0x3000000000050002` | DHCP Client Lease Deconfig | DHCP client lease deconfigured. | -
`0x3000000000050003` | DHCP Client Lease Renew | DHCP client lease renewed. | -
`0x3000000000050004` | DHCP Client Lease Bound | DHCP client lease bound to an address. | -
`0x3000000000050005` | DHCP Client Received NAK | DHCP client received a negative acknowledgment (NAK). | -
`0x3000000000050006` | DHCP Client Lease Failed | DHCP client lease acquisition failed. | -
`0x3000000000050100` | DHCP Server Discover | DHCP server received a discover message. | -
`0x3000000000050101` | DHCP Server Offer | DHCP server sent an offer message. | -
`0x3000000000050102` | DHCP Server Request | DHCP server received a request message. | -
`0x3000000000050103` | DHCP Server Acknowledge | DHCP server sent an acknowledge message. | -
`0x3000000000050104` | DHCP Server Release | DHCP server received a release message. | -
`0x3000000000050105` | DHCP Server NAK | DHCP server sent a negative acknowledgment (NAK). | -
`0x3000000000050106` | DHCP Server Decline | DHCP server received a decline message. | -
`0x3000000000050107` | DHCP Server Inform | DHCP server received an inform message. | -
`0x3000000000050108` | DHCP Server No Address Available | DHCP server has no address available to assign. | -
`0x3000000000060001` | Configuration Changed | A configuration change was made. | -
`0x3000000000070001` | Enter Maintenance Mode | System entered maintenance mode. | -
`0x3000000000070002` | Exit Maintenance Mode | System exited maintenance mode. | -
`0x3000000000080000` | MRP Ring OK | MRP ring is operational. | -
`0x3000000000080001` | MRP Ring Broken | MRP ring is broken. | -
`0x3000000000090000` | NTP Clock Synchronised | NTP clock synchronised successfully. | -
`0x3000000000090001` | NTP Update Failed | NTP clock update failed. | -
`0x30000000000a0000` | FRNT Ring OK | FRNT ring is operational. | -
`0x30000000000a0001` | FRNT Ring Broken | FRNT ring is broken. | -
`0x30000000000b0000` | Duplicate IP Address | A duplicate IP address was detected. | -
`0x30000000000b0001` | Duplicate MAC Address | A duplicate MAC address was detected. | -
`0x30000000000b0002` | ARP New Entry | A new ARP entry was added. | -
`0x30000000000b0003` | ARP Entry Changed | An ARP entry was changed. | -
`0x30000000000b0004` | ARP Entry Flip Flop | ARP entry is rapidly changing (flip-flop detected). | -
`0x30000000000c0000` | RICO Port State Change | RICO port state changed. | -
`0x30000000000d0000` | ATU Full Violation | Address Translation Unit (ATU) is full. | -
`0x30000000000e0000` | Unknown IPv4 Route Install | An unknown IPv4 route was installed. | -
`0x30000000000e0001` | Unknown IPv4 Route Delete | An unknown IPv4 route was deleted. | -
`0x30000000000e0002` | Kernel IPv4 Route Install | A kernel IPv4 route was installed. | -
`0x30000000000e0003` | Kernel IPv4 Route Delete | A kernel IPv4 route was deleted. | -
`0x30000000000e0004` | Connected IPv4 Route Install | A connected IPv4 route was installed. | -
`0x30000000000e0005` | Connected IPv4 Route Delete | A connected IPv4 route was deleted. | -
`0x30000000000e0006` | Static IPv4 Route Install | A static IPv4 route was installed. | -
`0x30000000000e0007` | Static IPv4 Route Delete | A static IPv4 route was deleted. | -
`0x30000000000e0008` | RIP IPv4 Route Install | A RIP IPv4 route was installed. | -
`0x30000000000e0009` | RIP IPv4 Route Delete | A RIP IPv4 route was deleted. | -
`0x30000000000e000a` | OSPF IPv4 Route Install | An OSPF IPv4 route was installed. | -
`0x30000000000e000b` | OSPF IPv4 Route Delete | An OSPF IPv4 route was deleted. | -
`0x30000000000e000c` | Kernel IPv6 Route Install | A kernel IPv6 route was installed. | -
`0x30000000000e000d` | Kernel IPv6 Route Delete | A kernel IPv6 route was deleted. | -
`0x30000000000e000e` | Connected IPv6 Route Install | A connected IPv6 route was installed. | -
`0x30000000000e000f` | Connected IPv6 Route Delete | A connected IPv6 route was deleted. | -
`0x30000000000e0010` | Static IPv6 Route Install | A static IPv6 route was installed. | -
`0x30000000000e0011` | Static IPv6 Route Delete | A static IPv6 route was deleted. | -
`0x30000000000e0012` | RIP IPv6 Route Install | A RIP IPv6 route was installed. | -
`0x30000000000e0013` | RIP IPv6 Route Delete | A RIP IPv6 route was deleted. | -
`0x30000000000e0014` | OSPF IPv6 Route Install | An OSPF IPv6 route was installed. | -
`0x30000000000e0015` | OSPF IPv6 Route Delete | A OSPF IPv6 route was deleted. | -
`0x30000000000e0016` | Unknown IPv6 Route Install | An unknown IPv6 route was installed. | -
`0x30000000000e0017` | Unknown IPv6 Route Delete | An unknown IPv6 route was deleted. | -
`0x30000000000e0018` | Multicast IPv4 Route Install | A multicast IPv4 route was installed. | -
`0x30000000000e0019` | Multicast IPv4 Route Delete | A multicast IPv4 route was deleted. | -
`0x30000000000f0000` | Link Alarm Actived | A link alarm was activated. | -
`0x30000000000f0001` | Link Alarm Deactived | A link alarm was deactivated. | -
`0x30000000000f0002` | Temp Alarm Actived | A temperature alarm was activated. | -
`0x30000000000f0003` | Temp Alarm Deactived | A temperature alarm was deactivated. | -
`0x30000000000f0004` | Power Alarm Actived | A power alarm was activated. | -
`0x30000000000f0005` | Power Alarm Deactived | A power alarm was deactivated. | -
`0x30000000000f0006` | Digin Alarm Actived | A digital input alarm was activated. | -
`0x30000000000f0007` | Digin Alarm Deactived | A digital input alarm was deactivated. | -
`0x30000000000f0008` | Ping Alarm Actived | A ping alarm was activated. | -
`0x30000000000f0009` | Ping Alarm Deactived | A ping alarm was deactivated. | -
`0x30000000000f000a` | FRNT Alarm Actived | A FRNT alarm was activated. | -
`0x30000000000f000b` | FRNT Alarm Deactived | A FRNT alarm was deactivated. | -
`0x30000000000f000c` | Ring Alarm Actived | A ring alarm was activated. | -
`0x30000000000f000d` | Ring Alarm Deactived | A ring alarm was deactivated. | -
`0x30000000000f000e` | Profinet Alarm Actived | A Profinet alarm was activated. | -
`0x30000000000f000f` | Profinet Alarm Deactived | A Profinet alarm was deactivated. | -
`0x30000000000f0010` | POE Alarm Actived | A PoE alarm was activated. | -
`0x30000000000f0011` | POE Alarm Deactived | A PoE alarm was deactivated. | -
`0x30000000000f0012` | RICO Alarm Actived | A RICO alarm was activated. | -
`0x30000000000f0013` | RICO Alarm Deactived | A RICO alarm was deactivated. | -
`0x30000000000f0014` | Media Threshold Alarm Actived | A media threshold alarm was activated. | -
`0x30000000000f0015` | Media Threshold Alarm Deactived | A media threshold alarm was deactivated. | -
`0x30000000000f0016` | Media Plug Alarm Actived | A media plug alarm was activated. | -
`0x30000000000f0017` | Media Plug Alarm Deactived | A media plug alarm was deactivated. | -
`0x3000000000100000` | Media Plugged In | A media device, e.g. a USB device or SD card, was plugged in. This does not indicate that the device has been mounted or is ready for use. | -
`0x3000000000100001` | Media Removed | A media device was removed. | -
`0x3000000000100002` | Media Mounted | A media device was mounted. The device is now available and ready for use. | -
`0x3000000000100003` | Media Unmounted | A media device was unmounted. | -
`0x3000000000100004` | Media Mount Failed | Media Mount Failed. | -
`0x3000000000110000` | Firewall Allow Rule Hit | A firewall allow rule was hit. | -
`0x3000000000110001` | Firewall Deny Rule Hit | A firewall deny rule was hit. | -
`0x3000000000120000` | Certificate has been revoked | A certificate was revoked. | -
`0x3000000000120001` | CRL distribution point not accessible | The Certificate Revocation List (CRL) distribution point could not be accessed. | -
`0x3000000000120002` | CRL expired | The Certificate Revocation List (CRL) has expired. | -
`0x3000000000120003` | CRL signature verification failed | CRL signature verification failed. | -
`0x3000000000120004` | CRL too large for download | CRL was too large to download. | -
`0x3000000000120005` | SSH host key management | SSH host key management event occurred. | -
`0x3000000000120006` | SSH host key management failure | SSH host key management failure event occurred. | -
`0x3000000000120007` | Weak/deprecated certificate used | Weak/deprecated certificate used. | -
`0x3000000000130000` | Custom Telegram Publish | Custom Telegram Publish. | -
`0x3000000000130001` | Custom Telegram Subscribe | Custom Telegram Subscribe. | -
`0x3000000000130002` | Custom Telegram System Clock Changed | Custom telegram indicating system clock change. | -
`0x3000000000130003` | Custom Telegram Inhibit Flag Changed | Custom telegram indicating inhibit flag change. | -
`0x3000000000130004` | Custom Telegram Bypass-relay Changed | Custom telegram indicating bypass-relay change. | -
`0x3000000000140000` | Package Installed | A software package has been installed. | -
`0x3000000000140001` | Package Removed | A software package has been removed. | -
`0x3000000000150000` | TPM Error | A Trusted Platform Module (TPM) error occurred. | -
`0x3000000000160000` | System time manually set | System time manually set. | -
`0x3000000000160001` | System time manually set failure | Failure occurred while manually setting system time. | -
`0x3000000000160002` | RTC time manually set | Real-Time Clock (RTC) time was manually set. | -
`0x3000000000160003` | RTC time manually set failure | Failure occurred while manually setting RTC time. | -
`0x3000000000160004` | RTC chip incorrectly configured | RTC chip incorrectly configured. | -
`0x3000000000160005` | Failed setting configuration for RTC chip | Failed setting configuration for RTC chip. | -
`0x3000000000170000` | IPsec Closing Child SA | IPsec is closing a Child Security Association (SA). | -
`0x3000000000170001` | IPsec Established Child SA | IPsec has established a Child Security Association (SA). | -
`0x3000000000170002` | IPsec Reauth IKE SA | IPsec Reauth Internet Key Exchange (IKE) Security Association (SA). | -
`0x3000000000170003` | IPsec Closing IKE SA | IPsec Closing Internet Key Exchange (IKE) Security Association (SA). | -
`0x3000000000180000` | App Start | A container application was started. | -
`0x3000000000180001` | App Stop | A container application was stopped. | -
`0x3000000000180002` | App Restart | A container application was restarted. | -
`0x3000000000180003` | App Attach | A user attached to a running application container console. | -
`0x3000000000180004` | App Reload | An application was reloaded after configuration or image label changes. | -
`0x3000000000180005` | App Update Label On Image | An image label was updated or assigned to an application image. | -
`0x3000000000180006` | App Load All | All configured applications were loaded and initialized. | -
`0x3000000000180007` | App Signature Verification | An application image signature was verified. | -
`0x3000000000180008` | App Delete | An application instance or application image was deleted. | -

Table 4: Control System Events

Note that this simply lists what can be logged, what is logged is dependent on the configuration of the system. For instance, no audit events will be generated related to DHCP server if no DHCP server is configured.

#### Backup Restore Events

The following Event IDs are available for the Backup Restore Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x4000000000010000` | Update Running Configuration | The system running configuration was updated after successful activation. | -
`0x4000000000020000` | Read Config File | A configuration file was read. | -
`0x4000000000020001` | Read Config File Error | Failed to read configuration file. | -
`0x4000000000020002` | Read Config File Error - JSON | JSON parsing error while reading the configuration file. | -
`0x4000000000020003` | Read Config File Error - No Exist | Configuration file not found. | -
`0x4000000000030000` | Validate Config File | Configuration file validation was initiated. | -
`0x4000000000040000` | Write Config File | Configuration was written to file. | -
`0x4000000000040001` | Write Config File Error | Failed to open configuration file for writing. | -
`0x4000000000040002` | Write Config File Error - JSON | JSON formatting or encoding error while writing the configuration file. | -
`0x4000000000050000` | Copied Config File - CLI | Configuration file copied via CLI command. | -
`0x4000000000050001` | Copy Config File Error - CLI | Error occurred while copying configuration file via CLI. | -
`0x4000000000060000` | Verify Config File Encryption | Configuration file encryption verification. | -
`0x4000000000070000` | Support File Generated | A support file for troubleshooting was created. | -
`0x4000000000080000` | JSON Schema validation successful | Configuration file passed JSON schema validation. | -
`0x4000000000080001` | JSON Schema validation fail | Configuration file failed JSON schema validation. | -
`0x4000000000080002` | JSON Schema validation fail with error | Configuration file failed JSON schema validation with specific error details. | -
`0x4000000000080003` | JSON Schema validation fail, force apply | Configuration was force applied despite JSON schema validation failure. | -
`0x4000000000080004` | JSON Schema validation fail, force copy | Configuration file was force copied despite JSON schema validation failure. | -
`0x4000000000090000` | Web Enable Config Force Apply | Force apply option temporarily enabled for current web session. | -
`0x4000000000090001` | Web Disable Config Force Apply | Force apply option disabled for current web session. | -
`0x4000000000090002` | Web Config Force Apply | Configuration change was force applied via web interface, validation checks were ignored. | -

Table 5: Backup Restore Events

#### Configuration Change Events

The following Event IDs are available for the Configuration Change category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x5000000000020000` | LLDP | Configuration change related to LLDP (Link Layer Discovery Protocol). | -
`0x5000000000020001` | LLDP Port | Configuration change for an LLDP-enabled port. | -
`0x5000000000030000` | DHCP Server | Configuration change to the DHCP server settings. | -
`0x5000000000030001` | DHCP Server Subnet | Configuration change to a DHCP server subnet. | -
`0x5000000000030002` | DHCP Server Host | Configuration change to a DHCP server host entry. | -
`0x5000000000030003` | DHCP Server Route | Configuration change to a DHCP server route. | -
`0x5000000000030004` | DHCP Server Host Match | Configuration change to DHCP server host matching rules. | -
`0x5000000000030005` | DHCP Server Static Leases | Configuration change to DHCP server static lease assignments. | -
`0x5000000000040000` | SSH | Configuration change related to SSH settings. | -
`0x5000000000040001` | SSH Shell access | Configuration change for SSH shell access permissions. | -
`0x5000000000050000` | Telnet | Configuration change related to Telnet settings. | -
`0x5000000000060000` | Port | Configuration change to a network port. | -
`0x5000000000060001` | Ethernet Port | Configuration change to an Ethernet port. | -
`0x5000000000070000` | Ownership | Configuration change to system or resource ownership. | -
`0x5000000000080000` | System | General system configuration change. | -
`0x5000000000090000` | TFTP | Configuration change related to TFTP settings. | -
`0x50000000000a0000` | DNS | Configuration change related to DNS settings. | -
`0x50000000000a0001` | DNS Forward Rule | Configuration change to DNS forwarding rules. | -
`0x50000000000a0002` | DNS Server | Configuration change to a DNS server entry. | -
`0x50000000000a0003` | DNS Host | Configuration change to a DNS host entry. | -
`0x50000000000a0004` | DNS Search Path | Configuration change to DNS search path settings. | -
`0x50000000000b0000` | NTP | Configuration change related to NTP (Network Time Protocol) settings. | -
`0x50000000000b0001` | NTP Client | Configuration change to NTP client settings. | -
`0x50000000000c0000` | WEB | Configuration change related to web interface settings. | -
`0x50000000000c0001` | HTTP | Configuration change to HTTP settings. | -
`0x50000000000c0002` | HTTPS | Configuration change to HTTPS settings. | -
`0x50000000000d0000` | RSTP | Configuration change related to RSTP (Rapid Spanning Tree Protocol). | -
`0x50000000000d0001` | RSTP Port | Configuration change to an RSTP-enabled port. | -
`0x50000000000e0000` | FRNT | Configuration change related to FRNT (Fast Recovery Network Topology). | -
`0x50000000000e0001` | FRNT Port | Configuration change to a FRNT port. | -
`0x50000000000f0000` | ICMP | Configuration change related to ICMP (Internet Control Message Protocol) settings. | -
`0x5000000000100000` | Management | Configuration change to management interface or settings. | -
`0x5000000000110000` | Password | Configuration change to a password or password policy. | -
`0x5000000000120000` | VRRP | Configuration change related to VRRP (Virtual Router Redundancy Protocol). | -
`0x5000000000120001` | VRRP Trigger | Configuration change to VRRP trigger settings. | -
`0x5000000000120002` | VRRP Instance | Configuration change to a VRRP instance. | -
`0x5000000000120003` | VRRP Group | Configuration change to a VRRP group. | -
`0x5000000000130000` | RIP Interface | Configuration change to a RIP (Routing Information Protocol) interface. | -
`0x5000000000130001` | RIP Interface MD5 | Configuration change to RIP interface MD5 authentication. | -
`0x5000000000130002` | RIP Interface Secret | Configuration change to RIP interface secret settings. | -
`0x5000000000130003` | RIP Interface Auth | Configuration change to RIP interface authentication settings. | -
`0x5000000000140000` | RIP | Configuration change related to RIP protocol. | -
`0x5000000000140001` | RIP Network | Configuration change to a RIP network entry. | -
`0x5000000000150000` | OSPF Interface | Configuration change to an OSPF (Open Shortest Path First) interface. | -
`0x5000000000150001` | OSPF Interface MD5 | Configuration change to OSPF interface MD5 authentication. | -
`0x5000000000150002` | OSPF Interface Secret | Configuration change to OSPF interface secret settings. | -
`0x5000000000150003` | OSPF Interface Auth | Configuration change to OSPF interface authentication settings. | -
`0x5000000000160000` | OSPF | Configuration change related to OSPF protocol. | -
`0x5000000000160001` | OSPF Network | Configuration change to an OSPF network entry. | -
`0x5000000000160002` | OSPF Area | Configuration change to an OSPF area. | -
`0x5000000000160003` | OSPF Timers | Configuration change to OSPF timer settings. | -
`0x5000000000160004` | OSPF Redistribute | Configuration change to OSPF route redistribution settings. | -
`0x5000000000160005` | OSPF Distribute Default | Configuration change to OSPF default route distribution. | -
`0x5000000000170000` | PIM Interface | Configuration change to a PIM (Protocol Independent Multicast) interface. | -
`0x5000000000180000` | PIM | Configuration change related to PIM protocol. | -
`0x5000000000180001` | PIM Rendezvous Point | Configuration change to a PIM rendezvous point. | -
`0x5000000000180002` | PIM Policy | Configuration change to a PIM policy. | -
`0x5000000000180003` | PIM SSM Prefix | Configuration change to a PIM SSM (Source-Specific Multicast) prefix. | -
`0x5000000000190000` | Interface | Configuration change to a network interface. | -
`0x5000000000190001` | Interface IPv4 | Configuration change to an IPv4 interface. | -
`0x5000000000190002` | Interface IPv4 Address | Configuration change to an IPv4 address on an interface. | -
`0x5000000000190003` | Interface IPv6 | Configuration change to an IPv6 interface. | -
`0x50000000001a0000` | IP | Configuration change related to IP settings. | -
`0x50000000001a0001` | IP Route | Configuration change to an IP route. | -
`0x50000000001a0002` | IP Multicast Route | Configuration change to an IP multicast route. | -
`0x50000000001a0003` | IP NAT | Configuration change to IP NAT (Network Address Translation) settings. | -
`0x50000000001a0004` | Policy Route Match Ip | Configuration change to policy route IP match settings. | -
`0x50000000001a0005` | IP Policy Route Match | Configuration change to IP policy route match rules. | -
`0x50000000001a0006` | IP Policy Route | Configuration change to an IP policy route. | -
`0x50000000001b0000` | Firewall | Configuration change related to firewall settings. | -
`0x50000000001b0001` | Firewall Network | Configuration change to a firewall network object. | -
`0x50000000001b0002` | Firewall Rule | Configuration change to a firewall rule. | -
`0x50000000001b0003` | Firewall Counter | Configuration change to a firewall counter. | -
`0x50000000001b0004` | Firewall Log | Configuration change to firewall logging settings. | -
`0x50000000001c0000` | PoE | Configuration change related to Power over Ethernet (PoE) settings. | -
`0x50000000001c0001` | PoE Port | Configuration change to a PoE-enabled port. | -
`0x50000000001d0000` | AAA | Configuration change related to AAA (Authentication, Authorization, Accounting) settings. | -
`0x50000000001d0001` | AAA User SSH Key | Configuration change to a user’s SSH key in AAA settings. | -
`0x50000000001d0002` | AAA User | Configuration change to a user in AAA settings. | -
`0x50000000001d0003` | AAA Local User | Configuration change to a local user in AAA settings. | -
`0x50000000001d0004` | AAA Local Database | Configuration change to the AAA local user database. | -
`0x50000000001d0005` | AAA Remote Server | Configuration change to a remote AAA server. | -
`0x50000000001d0006` | AAA Server Group | Configuration change to a AAA server group. | -
`0x50000000001d0007` | AAA Server | Configuration change to a AAA server entry. | -
`0x50000000001d0008` | AAA Method | Configuration change to a AAA authentication method. | -
`0x50000000001d0009` | AAA MAC Pattern | Configuration change to a AAA MAC address pattern. | -
`0x50000000001d000a` | AAA Authentication | Configuration change to AAA authentication settings. | -
`0x50000000001d000b` | AAA 802.1x Auth Groups | Configuration change to AAA 802.1x authentication groups. | -
`0x50000000001d000c` | AAA MAC Auth Groups | Configuration change to AAA MAC authentication groups. | -
`0x50000000001d000d` | AAA Login Auth Groups | Configuration change to AAA login authentication groups. | -
`0x50000000001d000e` | AAA Password Policy | Configuration change to AAA password policy. | -
`0x50000000001d000f` | AAA Lockout Policy | Configuration change to AAA lockout policy. | -
`0x50000000001d0010` | AAA Authentication Chain | AAA Authentication Chain. | -
`0x50000000001e0000` | SSL | Configuration change related to SSL (Secure Sockets Layer) settings. | -
`0x50000000001e0001` | SSL Network | Configuration change to an SSL network object. | -
`0x50000000001e0002` | SSL Pool Range | Configuration change to SSL pool range settings. | -
`0x50000000001e0003` | SSL Internal Route | Configuration change to an SSL tunnel. | -
`0x50000000001e0004` | SSL Client Config | Configuration change to SSL client configuration. | -
`0x50000000001f0000` | Generic Routing Encap | Configuration change to GRE (Generic Routing Encapsulation) settings. | -
`0x5000000000200000` | Audit Logging | Configuration change to audit logging settings. | -
`0x5000000000210000` | IPSec | Configuration change related to IPSec (IP Security) settings. | -
`0x5000000000210001` | IPSec Remote CA | Configuration change to IPSec remote certificate authority settings. | -
`0x5000000000210002` | IPSec Protocol Port | Configuration change to IPSec protocol port settings. | -
`0x5000000000220000` | Tunnel | Configuration change to a network tunnel. | -
`0x5000000000220001` | SSL Tunnel | Configuration change to an SSL tunnel. | -
`0x5000000000220002` | GRE Tunnel | Configuration change to a GRE tunnel. | -
`0x5000000000220003` | IPSec Tunnel | Configuration change to an IPSec tunnel. | -
`0x5000000000230000` | IPv6 | Configuration change related to IPv6 settings. | -
`0x5000000000230001` | IPv6 Route | Configuration change to an IPv6 route. | -
`0x5000000000240000` | PTP | Configuration change related to PTP (Precision Time Protocol) settings. | -
`0x5000000000240001` | PTP Clock | Configuration change to a PTP clock. | -
`0x5000000000240002` | PTP Parameters | Configuration change to PTP parameters. | -
`0x5000000000250000` | TTDP | Configuration change related to TTDP (Time-Triggered Data Protocol) settings. | -
`0x5000000000250001` | TTDP ECN | Configuration change to TTDP ECN (Explicit Congestion Notification) settings. | -
`0x5000000000250002` | TTDP Multicast Route | Configuration change to TTDP multicast route settings. | -
`0x5000000000250003` | TTDP Port | Configuration change to a TTDP port. | -
`0x5000000000250004` | TTDP Internet | Configuration change to TTDP internet settings. | -
`0x5000000000250005` | TTDP Custom TRDP | Configuration change to TTDP CUTE (Custom User Traffic Engineering) settings. | -
`0x5000000000250006` | TTDP Custom TRDP Alias | TTDP Custom TRDP Alias. | -
`0x5000000000260000` | Watchdog | Configuration change to watchdog settings. | -
`0x5000000000260001` | Watchdog Monitor | Configuration change to watchdog monitor settings. | -
`0x5000000000270000` | VLAN | Configuration change related to VLAN (Virtual LAN) settings. | -
`0x5000000000270001` | VLAN Commons | Configuration change to common VLAN settings. | -
`0x5000000000270002` | VLAN dbnum | Configuration change to VLAN database number. | -
`0x5000000000280000` | LAG | Configuration change related to LAG (Link Aggregation Group) settings. | -
`0x5000000000280001` | LAG LACP | Configuration change to LAG LACP (Link Aggregation Control Protocol) settings. | -
`0x5000000000280002` | LAG TTPD | Configuration change to LAG TTPD settings. | -
`0x5000000000280003` | LAG Port | Configuration change to a LAG port. | -
`0x5000000000290000` | Action | Configuration change to an action or action list. | -
`0x5000000000290001` | Action Interface | Configuration change to an action interface list. | -
`0x50000000002a0000` | Trigger | Configuration change to a trigger or trigger list. | -
`0x50000000002b0000` | Alarm | Configuration change to an alarm or alarm settings. | -
`0x50000000002b0001` | Alarm Trigger | Configuration change to an alarm trigger list. | -
`0x50000000002b0002` | Alarm Action | Configuration change to an alarm action list. | -
`0x50000000002c0000` | Ring | Configuration change related to ring topology settings. | -
`0x50000000002c0001` | Ring Port | Configuration change to a ring port. | -
`0x50000000002c0002` | Ring MRP | Configuration change to ring MRP (Media Redundancy Protocol) settings. | -
`0x50000000002d0000` | Console | Configuration change to console access or settings. | -
`0x50000000002e0000` | RiCo | Configuration change related to RiCo (Ring Coupling) settings. | -
`0x50000000002e0001` | RiCo Coupling Port | Configuration change to a RiCo coupling port. | -
`0x50000000002e0002` | RiCo Subring | Configuration change to a RiCo subring. | -
`0x50000000002f0000` | DDNS | Configuration change related to DDNS (Dynamic DNS) settings. | -
`0x50000000002f0001` | DDNS Provider | Configuration change to a DDNS provider. | -
`0x50000000002f0002` | DDNS Custom Provider | Configuration change to a custom DDNS provider. | -
`0x50000000002f0003` | DDNS Builtin Provider | Configuration change to a built-in DDNS provider. | -
`0x5000000000300000` | Application Container | Configuration change to an application container. | -
`0x5000000000300001` | Application Container Share | Configuration change to an application container share. | -
`0x5000000000300002` | App Environment Variable | Configuration change to an application environment variable. | -
`0x5000000000300003` | App Capability | App Capability. | -
`0x5000000000310000` | SNMP | Configuration change related to SNMP (Simple Network Management Protocol) settings. | -
`0x5000000000310001` | SNMP Address | Configuration change to an SNMP IP address. | -
`0x5000000000310002` | SNMP User | Configuration change to an SNMP user. | -
`0x5000000000310003` | SNMP Trap Host | Configuration change to an SNMP trap host. | -
`0x5000000000310004` | SNMP Engine ID | Configuration change to an SNMP engine ID. | -
`0x5000000000310005` | SNMP Ifindex Persistence | Configuration change to SNMP ifIndex persistence settings. | -
`0x5000000000310006` | SNMP Command | Configuration change to an SNMP command. | -
`0x5000000000320000` | Monitor | Configuration change to monitoring settings. | -
`0x5000000000320004` | Monitor Destination | Configuration change to a monitoring destination. | -
`0x5000000000320006` | Monitor Source | Configuration change to a monitoring source. | -
`0x5000000000330000` | Serial Port | Configuration change to a serial port. | -
`0x5000000000340000` | Serial Port App | Configuration change to a serial port application. | -
`0x5000000000350000` | GPS | Configuration change related to GPS settings. | -
`0x5000000000360000` | HSR/PRP | Configuration change related to HSR (High-availability Seamless Redundancy) or PRP (Parallel Redundancy Protocol) settings. | -
`0x5000000000360001` | HSR/PRP Statistics | Configuration change to HSR/PRP statistics settings. | -
`0x5000000000360002` | HSR/PRP Port | Configuration change to an HSR/PRP port. | -
`0x5000000000360003` | HSR/PRP Pairing | Configuration change to HSR/PRP port pairing. | -
`0x5000000000370000` | Multicast DNS | Configuration change related to mDNS (Multicast DNS) settings. | -
`0x5000000000380000` | VRF | Configuration change related to VRF (Virtual Routing and Forwarding) settings. | -
`0x5000000000390001` | MPTCP | Configuration change related to MPTCP (Multipath TCP) settings. | -
`0x50000000003a0000` | Profinet | Configuration change related to Profinet protocol settings. | -
`0x50000000003b0000` | DHCP Relay | Configuration change related to DHCP relay settings. | -
`0x50000000003b0001` | DHCP Relay Interface | Configuration change to a DHCP relay interface. | -
`0x50000000003b0002` | DHCP Relay Server | Configuration change to a DHCP relay server. | -
`0x50000000003b0003` | DHCP Relay Option 82 | Configuration change to DHCP relay Option 82 settings. | -
`0x50000000003b0004` | DHCP Relay Port | Configuration change to a DHCP relay port. | -
`0x50000000003c0000` | CLI | Configuration change related to CLI (Command Line Interface) settings. | -
`0x50000000003d0000` | SSDP | Configuration change related to SSDP (Simple Service Discovery Protocol) settings. | -
`0x50000000003e0000` | Metrics | Configuration change to system metrics or monitoring settings. | -
`0x50000000003f0000` | Port Access DOT1X | Configuration change related to IEEE 802.1X authentication settings. | -
`0x50000000003f0001` | Port Access MAC auth | Configuration change to MAC-based authentication settings. | -
`0x50000000003f0002` | Port Access | Configuration change to port access control settings. | -
`0x50000000003f0003` | Port Access VLAN Assignment | Port Access VLAN Assignment. | -
`0x5000000000400000` | FDB | Configuration change to the forwarding database (FDB). | -
`0x5000000000400001` | FDB MAC | Configuration change to a MAC address in the forwarding database. | -
`0x5000000000400002` | FDB Group | Configuration change to a group in the forwarding database. | -
`0x5000000000410000` | RNRP | Configuration change related to RNRP (Redundant Network Ring Protocol) settings. | -
`0x5000000000410001` | RNRP Explicit | Configuration change to explicit RNRP settings. | -
`0x5000000000420000` | Vendor | Configuration change to vendor-specific settings. | -
`0x5000000000430000` | Policy | Configuration change to a policy or policy list. | -
`0x5000000000430001` | Policy Network | Configuration change to a policy network object. | -
`0x5000000000430002` | Policy Rule | Configuration change to a policy rule. | -
`0x5000000000430003` | Policy Port | Configuration change to a policy port. | -
`0x5000000000440000` | AT Command | Configuration change to an AT command. | -
`0x5000000000440001` | AT Map | Configuration change to an AT command map. | -
`0x5000000000440002` | AT Message | Configuration change to an AT command message. | -
`0x5000000000440003` | AT User Message | Configuration change to an AT user message. | -
`0x5000000000450000` | Logging | Configuration change to logging settings. | -
`0x5000000000450001` | Logging Source | Configuration change to a logging source. | -
`0x5000000000450002` | Logging Destination | Configuration change to a logging destination. | -
`0x5000000000450003` | Logging Filter | Configuration change to a logging filter. | -
`0x5000000000450004` | Logging Sink | Configuration change to a logging sink. | -
`0x5000000000460000` | TRDP | Configuration change related to TRDP (Train Real-time Data Protocol) settings. | -
`0x5000000000470000` | Router | Configuration change to router settings. | -
`0x5000000000480000` | RiCh | Configuration change related to RiCh (Ring Channel) settings. | -
`0x5000000000490000` | Factory Reset | Configuration change to factory reset settings or operation. | -
`0x5000000000500000` | Encrypted Secrets | Configuration change to encrypted secrets or secret management. | -
`0x5000000000510000` | Provisioning | Configuration change related to system provisioning. | -
`0x5000000000520000` | PKI | Configuration change related to PKI (Public Key Infrastructure) settings. | -
`0x5000000000520001` | PKI Server Status | Configuration change to PKI server status. | -
`0x5000000000520002` | PKI Enroll Server | Configuration change to PKI enrollment server settings. | -
`0x5000000000520003` | PKI Revocation | Configuration change to PKI certificate revocation settings. | -
`0x5000000000530000` | Bootloader Configuration | Bootloader Configuration. | -
`0x5000000000540000` | WireGuard | WireGuard. | -

Table 6: Configuration Change Events

These Event IDs are generated to account for any configuration change made to any configurable setting in the system. All events under the cluster `0x5000xxxxxxxxxxxx` provide a comprehensive record of configuration changes to any configurable setting in the system.

Referring to the list of auditable Event IDs, various configuration change events can be generated. Instead of having a unique Event ID for every single configuration setting, they are categorised based on the type of setting changed. For example, there are unique Event IDs for changes made to system, interfaces, ports, VLANs, DHCP-Server, etc.

As an example of a configuration change event, consider that we change a few settings under the `system` configuration, like this:

    example:/#> configure
    example:/config/#> system
    example:/config/system/#> hostname MySwitch
    example:/config/system/#> location My Location
    example:/config/system/#> contact My Contact
    example:/config/system/#> leave
    MySwitch:/#>

This should new generate three different audit log entries, with the Event ID representing configuration changes for `system`, which would be `0x5000000000080000`. Therefore, the generated audit log entries would look something like this:

    MySwitch:/#> audit
    MySwitch:/audit/#> show
    ╒ Audit log ring buffer, entries 1-3 of 142 ═══════════════════════════════════════════════════════════╕
    │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                           │
    │209  2025-03-10  Notice          admin          Configuration C...  system: "contact": from 'my       │
    │     12:18:44    Security        administrator  System              previous' -> 'My Contact'         │
    │                                                0x5000000000080000                                    │
    ├──────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │208  2025-03-10  Notice          admin          Configuration C...  system: "location": from 'other   │
    │     12:18:44    Security        administrator  System              location' -> 'My Location'        │
    │                                                0x5000000000080000                                    │
    ├──────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │207  2025-03-10  Notice          admin          Configuration C...  system: "hostname": from          │
    │     12:18:44    Security        administrator  System              'example' -> 'MySwitch'           │
    │                                                0x5000000000080000                                    │
    └──────────────────────────────────────────────────────────────────────────────────────────────────────┘
    Page 1 of 48 | Navigation: 'a' prev, 'd' next, 'q' quit, 'r' refresh, 'g' goto, 'l' display all

    MySwitch:/#>

As we can see they all share the same Event ID, but the message indicates the specific values that were changed. In this case we can see that we changed “contact”, “location”, and “hostname” settings under the `system` configuration.

#### Configuration Transaction Events

The following Event IDs are available for the Configuration Transaction category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x5100000000010000` | Start | Configuration transaction started. | -
`0x5100000000010001` | Start - Error | Error occurred while starting configuration transaction. | -
`0x5100000000020000` | End | Configuration transaction ended. | -
`0x5100000000020001` | End - Validation Fail | Configuration transaction ended with validation failure. | -
`0x5100000000020002` | End - Unchanged | Configuration transaction ended with no changes applied. | -
`0x5100000000020003` | Activation | Configuration transaction activated changes. | -
`0x5100000000020004` | End - Error | Error occurred while ending configuration transaction. | -
`0x5100000000030000` | Abort | Configuration transaction aborted. | -
`0x5100000000040000` | Lock | Configuration transaction lock acquired. | -
`0x5100000000050001` | Unlock | Configuration transaction lock released. | -
`0x5100000000060002` | Unlock - Error | Error occurred while releasing configuration transaction lock. | -

Table 7: Configuration Transaction Events

#### Audit Log Events

The following Event IDs are available for the Audit Log Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x6000000000010000` | Display | The audit log was displayed or viewed via CLI command. | -
`0x6000000000010001` | Display Category | Audit log entries were displayed filtered by a specific category. | -
`0x6000000000020000` | Clear Ring Buffer | The internal audit log ring buffer was cleared, removing all stored audit events. | -
`0x6000000000030000` | Reload wauditd | The audit daemon (wauditd) was reloaded to apply configuration changes. | -
`0x6000000000040000` | Export | Audit log entries were exported to an external file or destination. | -
`0x6000000000050000` | Search | A search operation was performed on the audit log using pattern matching or regex. | -
`0x6000000000060000` | Time Search | A time-based search was performed on the audit log to find entries within a specific time range. | -
`0x6000000000070000` | Display from Web | The audit log was displayed or accessed via the web interface. | -
`0x6000000000080000` | Remote Shell Access Enabled | Remote shell access (e.g., SSH) was enabled on the system. | -
`0x6000000000080001` | Remote Shell Access changed from outside CLI | Remote shell access setting was modified from outside the CLI (e.g., via SSH or web interface). | -

Table 8: Audit Log Events

#### File System Events

The following Event IDs are available for the File System Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x7000000000010000` | Copy | A file or directory was copied in the file system. | -
`0x7000000000010001` | Copy error | An error occurred during a file or directory copy operation. | -
`0x7000000000020000` | View | File view operation performed (e.g., file was opened or read). | -
`0x7000000000020001` | View error | An error occurred while viewing or accessing a file or directory. | -
`0x7000000000020002` | View diff | A difference between files was viewed. | -
`0x7000000000030000` | Erase | A file or directory was erased or deleted from the file system. | -
`0x7000000000030001` | Erase error | An error occurred during a file or directory erase operation. | -
`0x7000000000040000` | List directory | A directory listing operation was performed. | -
`0x7000000000040001` | List directory error | An error occurred during a directory listing operation. | -
`0x7000000000050001` | CRL downloaded | A certificate revocation list (CRL) was downloaded to the device. | -
`0x7000000000050002` | Config file created | A PKI configuration file was created on the device. | -
`0x7000000000050003` | Certificate enrolled | A certificate was successfully enrolled using SCEP. | -
`0x7000000000050004` | Certificate renewed | A certificate was successfully renewed using SCEP. | -
`0x7000000000050005` | PKI artifact import operation | A PKI artifact was imported into the device. | -
`0x7000000000050006` | PKI artifact generate operation | A PKI artifact was generated on the device. | -
`0x7000000000050007` | PKI artifact remove operation | A PKI artifact was removed from the device. | -
`0x7000000000050008` | Certificate enrollment failed. | A certificate enrollment operation failed. | -
`0x7000000000050009` | Certificate renewal failed. | A certificate renewal operation failed. | -
`0x700000000005000a` | PKI artifact import operation Fail | PKI artifact import operation failed. | -
`0x7000000000060000` | File Transfer Import | File transfer import operation performed. | -
`0x7000000000060001` | File Transfer Import Fail | File transfer import operation failed. | -
`0x7000000000060002` | File Transfer Export | File transfer export operation performed. | -
`0x7000000000060003` | File Transfer Export Fail | File transfer export operation failed. | -
`0x7000000000070000` | Upgrade Image Download | Upgrade image download operation performed. | -
`0x7000000000070001` | Upgrade Image Download Fail | Upgrade image download operation failed. | -
`0x7000000000080000` | Package File Download | Package file download operation performed. | -
`0x7000000000080001` | Package File Download Fail | Package file download operation failed. | -
`0x7000000000090000` | Unlock License File Import | Unlock License file import operation performed. | -
`0x7000000000090001` | Unlock License File Import Fail | Unlock License file import operation failed. | -
`0x70000000000a0000` | App Image Import | App Image Import. | -
`0x70000000000a0001` | App Image Import Fail | App Image Import Fail. | -

Table 9: File System Events

#### Configuration Integrity Events

The following Event IDs are available for the Configuration Integrity Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x8000000000010000` | Integrity Alert | Configuration file integrity verification failed. For instance, file hash does not match stored hash, or no fingerprint exists for the file. | -
`0x8000000000020000` | Integrity OK | Configuration file integrity verification successful. File hash matches stored hash. | -
`0x8000000000030000` | Integrity Warning | Configuration file integrity warning. For instance, hash not found in integrity database or failed to erase fingerprint. | -
`0x8000000000040000` | Update Integrity | Configuration file hash updated in the integrity database. | -
`0x8000000000050000` | Add to Integrity DB | Configuration file fingerprint added to the integrity database for tracking. | -
`0x8000000000060001` | CSTINFO file upload: validation successful | CSTINFO data file uploaded and passed correctness validation (syntax and semantic rules). | -
`0x8000000000060002` | CSTINFO file upload: validation failed, syntax error | CSTINFO data file upload failed: syntax validation error. | -
`0x8000000000060003` | CSTINFO file upload: validation failed, semantic error | CSTINFO data file upload failed: semantic correctness rules violation. | -
`0x8000000000060004` | CSTINFO file missing - ECSP services limited | CSTINFO data file not found at startup; ECSP services are limited. | -
`0x8000000000060005` | CSTINFO file syntax error - ECSP services limited | CSTINFO data file failed syntax validation at startup; ECSP services are limited. | -
`0x8000000000060006` | CSTINFO file semantic error - ECSP services limited | CSTINFO data file failed semantic correctness validation at startup; ECSP services are limited. | -
`0x8000000000060007` | CSTINFO file hash not stored - contents may be unreliable | CSTINFO data file hash not found in configuration; file integrity cannot be verified. | -
`0x8000000000060008` | CSTINFO file hash mismatch - contents may be unreliable | CSTINFO data file hash differs from stored value; file may have been modified unintentionally. | -
`0x8000000000060009` | CSTINFO file hash validation successful | CSTINFO data file passed all validation checks (correctness and integrity). | -
`0x8000000000070000` | Custom Telegram Dataset File Ok | Custom TRDP telegram dataset file passed all validation checks (correctness and integrity). | -
`0x8000000000070001` | Custom Telegram Dataset File Missing | Custom TRDP telegram dataset file not found; custom telegrams are disabled. | -
`0x8000000000070002` | Custom Telegram Dataset File Error | Custom TRDP telegram dataset file failed validation (syntax or semantic error); custom telegrams are disabled. | -
`0x8000000000070003` | Custom Telegram Dataset File Hash Mismatch | Custom TRDP telegram dataset file hash differs from stored value; file may have been modified unintentionally. | -
`0x8000000000070004` | Custom Telegram Dataset File Hash Accepted | Custom TRDP telegram dataset file hash accepted by operator after validation. | -

Table 10: Configuration Integrity Events

#### Boot Process Events

The following Event IDs are available for the Boot Process Event category:

Event ID | Event Name | Description | Note
--- | --- | --- | ---
`0x9000000000010000` | Boot Loader Configuration Integrity | Boot Loader Configuration Integrity verification status. | -
`0x9000000000010010` | ID-mem Integrity | ID-mem Integrity verification status. Note: The ID-mem integrity verification should not fail during operation. If it does, this may indicate that the product definition of the product has been manipulated. | -

Table 11: Boot Process Events

### Syslog Message Format for Auditable Events

For each audit event, a syslog message is by default generated and sent to the any configured logging destinations. For the audit events, the syslog message is formatted as follows:

    type="audit"; eventid=<EVENTID>; username=<USERNAME>; userid=<USERID>; userrole=<ROLE>; seqnum=<NUM>; eventidtext="<EVENT_TEXT>"; msg="<MESSAGE>";

The different fields are constructed so that they should be easily parsable. The fields are as follows:

Field | Description
--- | ---
`type` | The type of the message, in this case `audit`, and it will always be `audit` for audit events.
`eventid` | The unique event ID for the audit event, where `<EVENTID>` is the hexadecimal representation of the event ID.
`username` | The username of the user that generated the audit event. Where `<USERNAME>` is the username of the user.
`userid` | The user ID of the user that generated the audit event. Where `<USERID>` is the user ID of the user, as an integer.
`userrole` | The role of the user that generated the audit event. Where `<ROLE>` is the role of the user.
`seqnum` | The sequence number of the audit event. Where `<NUM>` is the sequence number of the event, as an integer.
`eventidtext` | The text representation of the event ID. Where `<EVENT_TEXT>` is the text representation of the event ID and category.
`msg` | A message that provides additional information about the audit event. Where `<MESSAGE>` is the specific message for the event.

Example of an actual syslog message generated for an audit event, in this case a Link Up event:

    type="audit"; eventid=0x3000000000020001; username=root; userid=0; userrole=system; seqnum=57; eventidtext="Control System Event - Link Up"; msg="port/interface ethX8";

Note on the Syslog Message Format

This is simply the message part of the syslog message, the header part is not included here. For information on the full syslog message format, please refer to the Logging documentation.

Sending Auditable Events With Syslog

When setting up logging on the device, one aspect is to specify the source of the log messages. When wanting to send log messages that originate from the device a source of type `local` is configured. In turn, this type can select a number of different local sources, one of them being `audit`. Therefore, when this local source type is selected, only log messages that fall within these auditable events will be sent to the configured logging destinations.

For more information on setting up logging sources, please refer to the Logging documentation.

If for some reason the syslog messages should not be generated for the auditable events, this can be configured in the CLI. Again, the auditable events will still be generated (unless they too are disabled), but they will not be sent to syslog, they will be stored in the local audit log ring buffer on the device.

## Configuration

Configuration options related Audit can be found in the top-level configuration context in the CLI:

    example:/#> configure
    example:/config/#> audit
    example:/config/audit/#>

`[no] enable [CATEGORY]`

  Enable or disable audit event logging

  This setting controls whether audit events are logged or not. It is enabled or disabled on a per event category basis.

  Default: Enabled, for all categories of audit events.

  Example

  Enable audit event logging for all categories:

      example:/config/audit/#> enable

  Disable audit event logging for all categories:

      example:/config/audit/#> no enable

  Enable audit event logging for a specific category:

      example:/config/audit/#> enable access-control

  Disable audit event logging for a specific category:

      example:/config/audit/#> no enable access-control

  Multiple categories can be enabled or disabled at the same time:

      example:/config/audit/#> enable access-control request-error

  `no`
    Disable audit event logging. If a specific category is provided, only that category will be disabled. If no category is provided, all categories will be disabled.
  `CATEGORY`

    Based on the list of available audit event categories, this is the category to enable or disable. If no category is provided, all categories will be enabled or disabled.

    TAB Completion

    When providing the category, tab completion can be used to list all available categories.

`[no] syslog`

  Enable or disable sending audit log messages to syslog

  This setting controls whether audit events are sent to syslog or not.

  Note

  Auditable event messages are always generated, if `enabled`, regardless of whether they are sent to syslog or not. On the device itself, they are stored separately from the syslog messages. If the auditable events are to be sent to a logging destination, this setting must be enabled.

  Default: Enabled

  Example

  Enable sending audit log messages to syslog:

      example:/config/audit/#> syslog

  Disable sending audit log messages to syslog:

      example:/config/audit/#> no syslog

  `no`
    Disable sending audit log messages to syslog.

## Operational Commands

Operational commands related to auditable events can be found in the audit context, located top-level `exec` context in the CLI:

    example:/#> audit
    example:/audit/#>

`list [eventid | category]`

  List the audit Categories and EventIDs that exist in the system.

  This command will list all of the existing audit event categories and event IDs that can be available for the system.

  Note on the Displayed Event IDs

  This list shows every possible event ID and category that can be generated by the system. When these events can be generated is dependent on the configuration of the system.

  Example

  List all available audit event categories and event IDs:

      example:/audit/#> list
      …

  `eventid`
    List only all available audit event IDs.
  `category`
    List only all available audit event categories.
`[show] status`

  Display basic status information about the internal audit ring buffer.

  This command will display the current status of the internal audit ring buffer, including the number of entries currently stored in the buffer.

  Example

  Display the current status of the audit ring buffer:

      example:/audit/#> status
      AUDIT RING-BUFFER STATUS
      Ring buffer count     : 72
      Ring buffer used size : 5.41 KB
      Ring buffer max size  : 1.00 MB

`clear`

  Clear the internal audit ring buffer.

  This command will clear the internal audit ring buffer, removing all locally stored audit events.

  Authorised Users Only

  This command is only accessible by `administrator` level users.

  Example

  Clear the internal audit ring buffer:

      example:/audit/#> clear
      Are you sure you want to clear the audit log? (y/N) y
      Clearing audit log…
      example:/audit/#>

### Viewing Auditable Events

Auditable events can be accessed and viewed in the CLI, from the `audit` context, accessed from the top level `exec` context:

    example:/#> audit
    example:/audit/#>

By default, when show commands are executed, the audit log will be attempted to be displayed in an interactive mode. This mode will display the audit log in a paginated format. If this is undesired, the entire terminal can be set to `no interactive`. Be aware that this will set no interactive mode for the entire CLI. Simply call `interactive` to re-enable the interactive mode.

Interactive Mode Over Console Connection

Be aware that by default when accessing the audit log though the CLI, the CLI will attempt to display the audit log in an interactive mode. Doing this over a console connection can be sluggish, as the output speed is limited by the baud rate of the connection.

Interactive Mode and Terminal Size

The interactive mode will attempt to display the audit log in a paginated format, based on the terminal size.

If the terminal size is not deemed large enough, the interactive mode will not be used, and the output will be displayed in a single page.

#### Viewing Entires in the Pager

When displaying the audit log in interactive mode, the output will be displayed in a paginated format. The following commands can be used to navigate the output:

Command | Key | Description
--- | --- | ---
Previous Page | `a` | Go to the previous page.
Next Page | `d` | Go to the next page.
Quit | `q` | Quit the pager. It should also be possible to exit the pager with `CTRL+C`. Simply pressing the enter key again will also exit the pager.
Refresh | `r` | Refresh the current page. This will also resize the terminal window.
Go to Page | `g` | Go to a specific page. You will be prompted to enter the page number.
List All | `l` | Display all entries at once. This will print all the entries and exit the pager.

### Commands

`show`

  Display the entire internal audit ring buffer.

  This command will display the entire internal audit ring buffer, showing all of the stored audit events.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entire audit ring buffer:

      example:/audit/#> show
      ╒ Audit log ring buffer, entries 1-4 of 149 ═════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │216  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:14    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │215  2025-03-10  Info            root           Control System …    interface vlan1 ip              │
      │     12:42:57    Security        system         DHCP Client Lea…    198.18.1.101 mask 24 broadcast  │
      │                                                0x3000000000050003  198.18.1.255 router 198.18.1.99 │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 38 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all
      example:/#>

`show last <NUMBER>`

  Display the last `NUMBER` of entries in the internal audit ring buffer.

  This command will display the last `NUMBER` of entries in the internal audit ring buffer.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the last 3 entries in the audit ring buffer:

      example:/audit/#> show last 3
      ╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │216  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:14    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 1 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all
      example:/#>

  `NUMBER`
    The number of entries to display, provided as an integer.
`show range <START> <NUM>`

  Show a range of entries in the audit ring buffer.

  The range is specified by a starting entry number `START` and the number of entries to display `NUM`, from the starting entry.

  The `START` number is ordered from lowest to highest, with 0 being the latest entry in the ring buffer. Entries are displayed backwards from `START`, so if `START` is 0 and `NUM` is 5, you will see the five latest entries.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display 3 entries beginning from the 6th entry in the audit ring buffer:

      example:/audit/#> show range 6 3
      ╒ Audit log ring buffer, entries 6-8 of 8 ═══════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:46    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 1 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all
      example:/#>

  `START`
    The starting entry number, provided as an integer. The starting entry is ordered from lowest to highest, with 0 being the latest entry in the ring buffer.
  `NUM`
    The number of entries to display, provided as an integer, from the starting entry.
`show time [[YYYY-MM[-DD]] [hh:mm[:ss]]] [[YYYY-MM[-DD]] [hh:mm[:ss]]]`

  Display the entries in the internal audit ring buffer within the specified time range.

  This command will display the entries in the internal audit ring buffer that fall within the specified time range.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entries in the audit ring buffer that fall within the time range from `2025-03-10 12:48:30` to `2025-03-10 12:48:50`:

      example:/audit/#> show time 2025-03-10 12:48:30 2025-03-10 12:48:50
      ╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:46    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 1 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all

  `YYYY`
    The year, provided as an integer.
  `MM`
    The month, provided as an integer between 1 and 12.
  `DD`
    The day, provided as an integer between 1 and 31.
  `hh`
    The hour, provided as an integer between 0 and 23.
  `mm`
    The minute, provided as an integer between 0 and 59.
  `ss`
    The second, provided as an integer between 0 and 59.
`show from [[YYYY-MM[-DD]] [hh:mm[:ss]]]`

  Display the entries in the internal audit ring buffer from the specified time.

  This command will display the entries in the internal audit ring buffer that have been generated with a timestamp that falls after the specified time.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entries in the audit ring buffer that have been generated from `2025-03-10 12:48:30`:

      example:/audit/#> show from 2025-03-10 12:48:30
      ╒ Audit log ring buffer, entries 9-12 of 12 ═════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │220  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:50:53    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:46    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 2 of 2 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all

  `YYYY`
    The year, provided as an integer.
  `MM`
    The month, provided as an integer between 1 and 12.
  `DD`
    The day, provided as an integer between 1 and 31.
  `hh`
    The hour, provided as an integer between 0 and 23.
  `mm`
    The minute, provided as an integer between 0 and 59.
  `ss`
    The second, provided as an integer between 0 and 59.
`show to [[YYYY-MM[-DD]] [hh:mm[:ss]]]`

  Display the entries in the internal audit ring buffer to the specified time.

  This command will display the entries in the internal audit ring buffer that have been generated with a timestamp that falls before the specified time.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entries in the audit ring buffer that have been generated to `2025-03-10 12:48:50`:

      example:/audit/#> show to 2025-03-10 12:48:50
      ╒ Audit log ring buffer, entries 1-3 of 148 ═════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE      EVENTID             MESSAGE                         │
      │219  2025-03-10  Info            admin          Audit Log Event     Entire audit log displayed      │
      │     12:48:46    Security        administrator  Display             from the CLI.                   │
      │                                                0x6000000000010000                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │218  2025-03-10  Notice          root           Access Control      Authentication successful for   │
      │     12:48:37    Auth            system         SSH login Success   user ‘admin’ from 198.18.1.99   │
      │                                                0x1000000000010020                                  │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root           Access Control      SSH login exit for user         │
      │     12:48:34    Auth            system         SSH login Exit      ‘admin’ from 198.18.1.99:33202  │
      │                                                0x1000000000010021                                  │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 50 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all

  `YYYY`
    The year, provided as an integer.
  `MM`
    The month, provided as an integer between 1 and 12.
  `DD`
    The day, provided as an integer between 1 and 31.
  `hh`
    The hour, provided as an integer between 0 and 23.
  `mm`
    The minute, provided as an integer between 0 and 59.
  `ss`
    The second, provided as an integer between 0 and 59.
`show search [case] "STRING"`

  Display the entries in the internal audit ring buffer that contain the specified string.

  This command will display the entries in the internal audit ring buffer that contain the specified string. The provided search string supports regular expressions. The search string will search based on the Event ID and the message of the audit event.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entries in the audit ring buffer that contain the string `SSH login`:

      example:/audit/#> show search “SSH login”
      ╒ Audit log ring buffer, entries 1-3 of 3 ═══════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE  EVENTID             MESSAGE                             │
      │218  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
      │     12:48:37    Auth            system     SSH login Success   ‘admin’ from 198.18.1.99            │
      │                                            0x1000000000010020                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root       Access Control      SSH login exit for user ‘admin’     │
      │     12:48:34    Auth            system     SSH login Exit      from 198.18.1.99:33202              │
      │                                            0x1000000000010021                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │115  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
      │     12:13:07    Auth            system     SSH login Success   ‘admin’ from 198.18.1.99            │
      │                                            0x1000000000010020                                      │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 1 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all

  `case`
    If the `case` argument is provided, the search will be case sensitive.
  `"STRING"`
    The string to search for, provided in double quotes. This is a free-form string that supports regular expressions.
`show category CATEGORY`

  Display the entries in the internal audit ring buffer that belong to the specified category.

  This command will display the entries in the internal audit ring buffer that belong to the specified category.

  Interactive Mode

  The output will, by default, be displayed in an interactive mode, if the terminal allows for it.

  Example

  Display the entries in the audit ring buffer that belong to the `access-control` category:

      example:/audit/#> show category “access-control”
      ╒ Audit log ring buffer, entries 1-5 of 5 ═══════════════════════════════════════════════════════════╕
      │SEQ  TIME        LEVEL/FACILITY  USER/ROLE  EVENTID             MESSAGE                             │
      │218  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
      │     12:48:37    Auth            system     SSH login Success   ‘admin’ from 198.18.1.99            │
      │                                            0x1000000000010020                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │217  2025-03-10  Notice          root       Access Control      SSH login exit for user ‘admin’     │
      │     12:48:34    Auth            system     SSH login Exit      from 198.18.1.99:33202              │
      │                                            0x1000000000010021                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │115  2025-03-10  Notice          root       Access Control      Authentication successful for user  │
      │     12:13:07    Auth            system     SSH login Success   ‘admin’ from 198.18.1.99            │
      │                                            0x1000000000010020                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │111  2025-03-10  Notice          admin      Access Control      CLI Domain shell exited             │
      │     12:12:51    Auth            admini…    Exit CLI Shell                                          │
      │                                            0x1000000000030001                                      │
      ├────────────────────────────────────────────────────────────────────────────────────────────────────┤
      │110  2025-03-10  Notice          admin      Access Control      CLI Domain shell accessed           │
      │     12:12:50    Auth            admini…    Enter CLI Shell                                         │
      │                                            0x1000000000030000                                      │
      └────────────────────────────────────────────────────────────────────────────────────────────────────┘
      Page 1 of 1 | Navigation: ‘a’ prev, ‘d’ next, ‘q’ quit, ‘r’ refresh, ‘g’ goto, ‘l’ display all

  `CATEGORY`

    The category to display, based on the available categories.

    TAB Completion

    The available categories can be tab completed in the CLI.

`show raw`

  Display the raw audit log file.

  This command will display the raw audit log file, showing all of the stored audit events. This is not displaying from the ring buffer storing the audit events, but from a local log file written with syslog. Therefore, the output in this file is how the audit messages would look also when sent to a remote syslog server.

  Number of Entries

  The number of entries that are stored in the raw audit log file is most likely going to be a lot less than what is stored in the internal audit ring buffer.

  Example

  Display the raw audit log file:

      example:/audit/#> show raw
      Mar 10 12:48:34 MySwitch wauditd[1624]: type=”audit”; eventid=0x1000000000010021; username=root; userid=0; userrole=system; seqnum=217; eventidtext=”Access Control - SSH login Exit”; msg=”SSH login exit for user ‘admin’ from 198.18.1.99:33202”;
      Mar 10 12:48:37 MySwitch wauditd[1624]: type=”audit”; eventid=0x1000000000010020; username=root; userid=0; userrole=system; seqnum=218; eventidtext=”Access Control - SSH login Success”; msg=”Authentication successful for user ‘admin’ from 198.18.1.99”;
      Mar 10 12:48:46 MySwitch wauditd[1624]: type=”audit”; eventid=0x6000000000010000; username=admin; userid=500; userrole=administrator; seqnum=219; eventidtext=”Audit Log Event - Display”; msg=”Entire audit log displayed from the CLI.”;

« Previous Next »