Using an audit server

Use the following procedure to configure an audit server.

If a cryptographic session is lost between the appliance and the audit server, audit records will not be sent, and the encrypted session will automatically reconnect when the peer is available on the network.

For more information on enabling logging on a remote server, see the description of the logging command in the CLI Reference.

Note

For best security, administrators must use SSH/HTTPS for remote administration sessions.

Prerequisites

Administrator access

To use an audit server:

Enter the CLI configuration mode:

hostname > enable
hostname # configure terminal

Specify the protocol to log in to the remote host. For example:
```
hostname (config) # logging <rsyslog-server> protocol tls
```
where <syslog-server> is the hostname or IP address of a rsyslog server where you want to send auditing messages.
SSL certificate verification is the configuration default and is required for compliance. If you are using an unverifiable certificate and are forced to make an exception, you can disable verification like this:
```
hostname (config) # no logging remote ssl cert-verify
```
Note
Running this command will move the appliance out of compliance.
Save your changes:
```
hostname (config) # write memory
```
Check the status:
```
hostname (config) # show logging
```

For example, the following typical configuration for compliance captures only auditing messages at the notice level and above:

cms9500-123 # show logging
Local logging level: notice
Override for class mgmt-back: info

Remote syslog default level: notice

Remote syslog servers:
172.16.22.11 notice
protocol: tls
port: 514

SSL min version: tls1.2
SSL cipher list: cc-ndcpp-high-security
verify peer certificate: no
OCSP enabled: yes
Default OCSP URL:
OCSP override responder: no

Receive remote messages via UDP: no

Receive remote messages via TCP: no

Receive remote messages via TLS: yes
Receiving port: 6514
SSL min version: tls1.2
SSL cipher list high-security

Log file rotation:
Log rotation size threshold: 256 
megabytes
Archived log files to keep: 40

Log format:
Timestamp format: rfc-3339

Subsecond timestamp field: disabled

Secure channel logs: yes
cms9500-123 #