Examples of audit messages

The following is the format of an audit message when entering compliance:

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: Compliance of system configuration with standard standard changed from not compliant to compliant.  However, runtime system state is still not compliant.  A reboot or other action may be required to complete the transition.

For example:

lc_log_audit(LOG_NOTICE, llac_standard, _("Compliance of system configuration with standard %s (%s) changed from %s to %s. ("However, runtime system state is still %s. A reboot or other action may be required to complete the transition."),std_str_friendly, std_str_friendly_long,md_compliance_standards_met[i] ? _("compliant") : _("not compliant"),now_met ? _("compliant") : _("not compliant"),now_met_state ? _("compliant") : _("not compliant"));

The following is the format of an audit message when exiting compliance:

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: Compliance of system configuration with standard <standard> changed from compliant to not compliant.

For example:

May  7 18:30:34 NX-7500-160 mgmtd[5917]: [mgmtd.NOTICE]: AUDIT: Compliance of system configuration with standard CC-NDPP (Common Criteria Network Device Protection Profile) changed from compliant to not compliant.

The following is the format of an audit message for a successful login attempt:

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: User login: username ‘username’, full name 'full name', role 'admin', client 'session-type', line 'terminal', remote address 'remote-ip', auth method 'method', auth submethod 'submethod', session ID session-id

For example:

2023-10-25T23:29:10 cms9500-123 mgmtd[24444]: [mgmtd.NOTICE]: AUDIT: User login: username 'root', full name 'Root User', role 'admin', client 'CLI', line 'pts/1', remote address '10.3.13.234', auth method 'local', auth submethod 'ssh_authorized_key', session ID 180

The following is the format of an audit message for an unsuccessful login attempt:

TimestampHostnameprocess[pid]: AUDIT: Authentication failure for user 'username' from host: remote-ip tty: terminal

For example:

2023-10-25T23:44:35 cms9500-123 sshd[27128]: AUDIT: Authentication failure for user 'admin2' from host: 10.3.13.234 tty: unknown

The following is the format of an audit message for an unsuccessful attempt to establish and SSH session:

TimestampHostnameprocess[pid]: fatal: Unable to negotiate a key exchange method [preauth]

For example:

Nov 6 16:25:24 fireeye-337038 sshd[13312]: fatal: Unable to negotiate a key exchange method [preauth]

The following is the format of an audit message for an unsuccessful attempt to establish a remote session:

TimestampHostnameprocess: process secure channel: failure reason

For example:

May 26 10:12:42 nx-2300-14 httpd: httpd secure channel: SSL library error 1 in handshake with 10.2.6.83 (server localhost:443)

May 26 10:12:42 nx-2300-14 httpd: httpd secure channel: connection closed to 10.2.6.83 with abortive shutdown (server localhost:443)

Setting the clock is logged in multiple audit messages that specify the action ID and parameters. The following are the formats of various audit messages when the clock has been set:

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: Action ID ID: requested by: user username (full name) via session

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: Action ID ID: descr: system clock: set date and time

TimestampHostname mgmtd[pid]: [mgmtd.NOTICE]: AUDIT: Action ID ID: param: date and time: date and time

For example:

May 27 16:57:08 nx-2300-14 mgmtd[4085]: [mgmtd.NOTICE]: AUDIT: Action ID 2787: requested by: user admin (System Administrator) via CLI (session ID 251576)

May 27 16:57:08 nx-2300-14 mgmtd[4085]: [mgmtd.NOTICE]: AUDIT: Action ID 2787: descr: system clock: set date and time

May 27 16:57:08 nx-2300-14 mgmtd[4085]: [mgmtd.NOTICE]: AUDIT: Action ID 2787: param: date and time: 1970/01/01 00:00:00

Jan  1 00:00:00 nx-2300-14 mgmtd[4085]: [mgmtd.NOTICE]: AUDIT: Time change detected, clock was moved 16582d 16h 57m 8.301s backward

May  7 21:17:48 NX-7500-160 mgmtd[5914]: [mgmtd.NOTICE]: AUDIT: system logger is started

May  7 21:14:58 NX-7500-160 mgmtd[5916]: [mgmtd.NOTICE]: AUDIT: shutting down system logger

May  7 21:17:48 NX-7500-160 pm[5913]: [pm.NOTICE]: AUDIT: PM successfully launched all processes
May  7 21:17:48 NX-7500-160 pm[5913]: [pm.NOTICE]: AUDIT: System initialization completed

The following is the format of an audit message when the CLI automatic logs out due to inactivity:

TimestampHostname cli[pid]: [cli.NOTICE]: AUDIT: user username: Automatic logout due to keyboard inactivity

For example:

May  8 05:08:19 NX-7500-160 cli[33580]: [cli.NOTICE]: AUDIT: user admin: Automatic logout due to keyboard inactivity
May  8 05:08:19 NX-7500-160 mgmtd[5914]: [mgmtd.NOTICE]: AUDIT: User logout: username 'admin', full name 'System Administrator', role 'admin', client 'CLI', line 'pts/1', remote address '10.3.7.112', auth method 'local', auth submethod 'password', session ID 6008

The following is the format of an audit message when a user logs out of the CLI:

TimestampHostname cli[pid]: [cli.NOTICE]: AUDIT: User logout: username username, full name fullname, role role, client 'client', line 'line', remote address 'address', auth method 'method', auth submethod 'password', session ID sessID

For example:

Nov 6 16:26:30 fireeye-337038 mgmtd[3250]: [mgmtd.NOTICE]: AUDIT: User logout: username 'admin', full name 'System Administrator', 
role 'admin', client 'CLI', line 'pts/1', remote address '10.59.71.203', auth method 'local', auth submethod 'password', 
session ID 14609

The following is the format of an audit message when the Web UI automatic logs out due to inactivity:

TimestampHostname wsmd[pid]: [wsmd.NOTICE]: AUDIT: Web session <session> timed out due to inactivity

For example:

May  8 05:15:25 NX-7500-160 wsmd[9936]: [wsmd.NOTICE]: AUDIT: Web session 1 timed out due to inactivity
May  8 05:15:25 NX-7500-160 mgmtd[5914]: [mgmtd.NOTICE]: AUDIT: User logout: username 'admin', full name 'System Administrator', role 'admin', client 'Web', line 'web/1', remote address '10.10.134.220', auth method 'local', auth submethod 'password', session ID 6042

The following is the format of an audit message when an account is locked after excessive authentication failures:

TimestampHostnameprocess_name[pid]: AUDIT: Denying access to user 'username': Maximum number of failed logins reached, account locked.  You may try again in lockout-time second(s).

For example:

May  8 05:19:12 NX-7500-160 sshd[26933]: AUDIT: Denying access to user 'admin': Maximum number of failed logins reached, account locked.  You may try again in 15 second(s).

The following is the format of the audit messages when an SSH session is established:

TimestampHostname sshd[pid]: sshd secure channel: client->server cipher: cipher, mac: mac [preauth]
TimestampHostname sshd[pid]: sshd secure channel: server->client cipher: cipher, mac: mac [preauth]
TimestampHostname sshd[pid]: sshd secure channel: kex: kex-method [preauth]
TimestampHostname sshd[pid]: sshd secure channel: SSH2 connection is established with remote-ip port remote-port [preauth]

For example:

May  8 05:33:29 NX-7500-160 sshd[34056]: sshd secure channel: client->server cipher: aes128-cbc, mac: hmac-sha1 [preauth]
May  8 05:33:29 NX-7500-160 sshd[34056]: sshd secure channel: server->client cipher: aes128-cbc, mac: hmac-sha1 [preauth]
May  8 05:33:29 NX-7500-160 sshd[34056]: sshd secure channel: kex: diffie-hellman-group14-sha1 [preauth]
May  8 05:33:29 NX-7500-160 sshd[34056]: sshd secure channel: SSH2 connection is established with 172.16.225.75 port 33405 [preauth]

The following is the format of the audit messages when an SSH session is terminated:

TimestampHostname> sshd[pid]: sshd secure channel: Connection closed by remote-ipTimestampHostname sshd[pid]: sshd secure channel: Closing connection to remote-ip port remote-portTimestampHostname sshd[pid]: sshd secure channel: sshd is terminated.

For example:

May  8 05:33:30 NX-7500-160 sshd[34056]: sshd secure channel: Connection closed by 172.16.225.75
May  8 05:33:30 NX-7500-160 sshd[34056]: sshd secure channel: Closing connection to 172.16.225.75 port 33405
May  8 05:33:30 NX-7500-160 sshd[34056]: sshd secure channel: sshd is terminated.

The following is the format of the audit message when an HTTPS session is established:

TimestampHostname httpd: httpd secure channel: SSL connection is established with remote-ip using cipher suite cipher.

For example:

May  8 05:13:24 NX-7500-160 httpd: httpd secure channel: SSL connection is established with 10.10.134.220 using cipher suite ECDHE-RSA-AES128-GCM-SHA256.

The following is the format of the audit message when an HTTPS session is terminated:

TimestampHostname httpd: httpd secure channel: connection closed to remote-ip with standard shutdown (server server-hostname:server-port)

For example:

May  8 05:13:24 NX-7500-160 httpd: httpd secure channel: connection closed to 10.10.134.220 with standard shutdown (server localhost:443)

The following is the format of the audit message when an encrypted rsyslog session is established:

TimestampHostname stunnel: stunnel secure channel: Connected to remote-ip:remote-port using cipher suite cipher

For example:

May  7 21:17:53 NX-7500-160 stunnel: stunnel secure channel: Connected to 172.16.225.63:60514 using cipher suite AES128-SHA256

May  7 21:17:51 NX-7500-160 stunnel: stunnel secure channel: Received signal 15; All connections will be terminated

The following is the format of the audit message when an encrypted LDAP session is established:

TimestampHostnameprocess-name[pid]: ldap secure channel: STARTTLS connection is established with remote-ip:remote-port using cipher suite cipher

For example:

May  8 06:09:39 NX-7500-160 sshd[19209]: ldap secure channel: STARTTLS connection is established with 10.2.6.64:389 using cipher suite AES128-SHA

The following is the format of the audit message when an encrypted LDAP session is terminated:

TimestampHostnameprocess-name[pid]: ldap secure channel: STARTTLS connection to remote-ip:remote-port is closed

For example:

May  8 06:09:39 NX-7500-160 sshd[19209]: ldap secure channel: STARTTLS connection to 10.2.6.64:389 is closed

Aug  4 16:09:00 hostname cli[16227]: [cli.NOTICE]: AUDIT: user admin: Executing command: username testuser role admin 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: requested by: user admin (System Administrator) via CLI (session ID 4450) 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: descr: Create local user account 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: param: username: "testuser"
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: param: account status: local login disabled 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: param: role: "admin"
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: requested by: user admin (System Administrator) via CLI (session ID 4450), 10 item(s) changed
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 1: local user account 'testuser': role 'admin' added 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 2: local user account 'testuser' added 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 3: local user account 'testuser': initially set to enabled 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 4: local user account 'testuser': user forced to change password on next local password login initially set to no 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 5: local user account 'testuser': full name initially set to ""
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 6: local user account 'testuser': home directory initially set to "/var/home/testuser"
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 7: local user account 'testuser': password initially set to (local login disabled) 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 8: local user account 'testuser': shell initially set to CLI 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 9: local user account 'testuser': subnet initially set to 0.0.0.0/0 
Aug  4 16:09:00 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 62: item 10: local user account 'testuser': vlan initially set to 0 
Aug  4 16:09:01 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 170: status: completed with success 
Aug  4 16:09:12 hostname cli[16227]: [cli.NOTICE]: AUDIT: user admin: Executing command: username testuser password 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: requested by: user admin (System Administrator) via CLI (session ID 4450) 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: descr: Set password on local user account
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: param: username: "testuser"
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: param: account status: undisclosed password set 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: param: new password: ******** 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 63: requested by: user admin (System Administrator) via CLI (session ID 4450), 3 item(s) changed 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 63: item 1: local user account 'testuser' old password #1 added 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 63: item 2: local user account 'testuser' old password #1: time set initially set to 2015/08/04 16:09:19 
Aug  4 16:09:19 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 63: item 3: local user account 'testuser': password changed from (local login disabled) to (undisclosed password set) 
Aug  4 16:09:20 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Action ID 171: status: completed with success

Aug  4 16:19:02 hostname cli[16755]: [cli.NOTICE]: AUDIT: user admin: Executing command: web server https enable 
Aug  4 16:19:02 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 69: requested by: user admin (System Administrator) via CLI (session ID 4569), 1 item(s) changed 
Aug  4 16:19:02 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 69: item 1: Web UI access via HTTPS changed from disabled to enabled

Aug  4 16:24:09 hostname cli[18289]: [cli.NOTICE]: AUDIT: user admin: Executing command: web server ssl cipher-list fips 
Aug  4 16:24:09 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 70: requested by: user admin (System Administrator) via CLI (session ID 4602), 1 item(s) changed 
Aug  4 16:24:09 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 70: item 1: HTTPS Server SSL/TLS cipher list changed from "compatible" to "fips"

Aug  4 16:16:48 hostname cli[5438]: [cli.NOTICE]: AUDIT: user admin: Executing command: ssh server enable 
Aug  4 16:16:48 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 67: requested by: user admin (System Administrator) via CLI (session ID 4560), 2 item(s) changed 
Aug  4 16:16:48 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 67: item 1: PM process 'sshd': auto-launch changed from disabled to enabled 
Aug  4 16:16:48 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 67: item 2: SSH server changed from disabled to enabled
Aug  4 16:26:39 hostname cli[1916]: [cli.NOTICE]: AUDIT: user admin: Executing command: ssh server cipher-list fips 
Aug  4 16:26:39 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 71: requested by: user admin (System Administrator) via CLI (session ID 4617), 1 item(s) changed 
Aug  4 16:26:39 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 71: item 1: SSH server cipher list changed from "compatible" to "fips"

Aug  4 16:31:46 hostname cli[30862]: [cli.NOTICE]: AUDIT: user admin: Executing command: aaa authentication login default ldap local 
Aug  4 16:31:46 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 74: requested by: user admin (System Administrator) via CLI (session ID 4725), 3 item(s) changed 
Aug  4 16:31:46 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 74: item 1: AAA authentication method 1: method changed from "local" to "ldap"
Aug  4 16:31:46 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 74: item 2: AAA authentication method 2 added 
Aug  4 16:31:46 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 74: item 3: AAA authentication method 2: method initially set to "local"

Aug  4 07:35:15 hostname cli[10312]: [cli.NOTICE]: AUDIT: user admin: Executing command: image install image-emps.img 
Aug  4 07:35:15 hostname mgmtd[6053]: [mgmtd.NOTICE]: AUDIT: Action ID 20: requested by: user admin (System Administrator) via CLI (session ID 473) 
Aug  4 07:35:15 hostname mgmtd[6053]: [mgmtd.NOTICE]: AUDIT: Action ID 20: descr: install system software image 
Aug  4 07:35:15 hostname mgmtd[6053]: [mgmtd.NOTICE]: AUDIT: Action ID 20: param: image filename: image-emps.img, version: emps eMPS (eMPS) 7.6.1.400889 #400889 2015-08-03 20:45:35 x86_64 build@vta-tc:FireEye/7.6.x-mammoth (eng)
Aug  4 07:35:15 hostname mgmtd[6053]: [mgmtd.NOTICE]: AUDIT: Action ID 20: param: switch next boot location after install: no 
Aug  4 07:38:10 hostname mgmtd[6053]: [mgmtd.NOTICE]: AUDIT: Action ID 20: status: completed with success

Aug  4 16:35:47 hostname cli[30862]: [cli.NOTICE]: AUDIT: user admin: Executing command: cli session auto-logout 10

Aug  4 16:37:28 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 79: requested by: user admin (System Administrator) via CLI (session ID 4725), 1 item(s) changed 
Aug  4 16:37:28 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 79: item 1: Web UI inactivity timeout changed from 25 minutes to 20 minutes

Aug  4 16:38:01 hostname cli[30862]: [cli.NOTICE]: AUDIT: user admin: Executing command: banner login-remote "System login banner"
Aug  4 16:38:01 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 80: requested by: user admin (System Administrator) via CLI (session ID 4725), 1 item(s) changed 
Aug  4 16:38:01 hostname mgmtd[8140]: [mgmtd.NOTICE]: AUDIT: Config change ID 80: item 1: login message: network ("issue_net") changed from " This system is for the use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel.  In the course of monitoring individuals improperly using this system, or in the course of system maintenance, the activities of auth..." (truncated) to "System login banner"