HP AE370A - Brocade 4Gb SAN Switch 4/12, Administrator'S Manual

Page: 52 / 447

52 Performing basic configuration tasks
Table 6 identifies auditable event classes and
auditCfg
operands used to enable auditing of a specific
class.
Audit events have the following message format:
Switch names are logged for switch components and chassis names for chassis components. For example,
a chassis name might be FWDL or RAS and a switch component name might be zone, name server, or
SNMP.
Pushed messages contain the administration domain of the entity that generated the event. See the
Fabric
OS Message Reference
for details on message formats. See ” Working with diagnostic features ” on
page 267 for details on setting up the system error log daemon.
Audit logging assumes that your syslog is operational and running. Before configuring an audit log, you
must perform the following steps to ensure that the host syslog is operational and running.
How to verify host syslog prior to configuring the audit log
1. Set up an external host machine with a system message log daemon running to receive the audit events
that will be generated.
2. On the switch where the audit configuration is enabled, enter the
syslogdipaddrAdd
command to
add the IP address of the host machine so that it can receive the audit events.
3. Ensure the network is configured with a network connection between the switch and the remote host.
4. Check the host SYSLOG configuration. If all error levels are not configured, you may not see some of
the audit messages.
Table 6 AuditCfg Event Class Operands
Operand Event class Description
1 Zone Audit zone event configuration changes, but not the actual values
that were changed. For example, you a message might state,
“Zone configuration has changed,” but the syslog does not
display the actual values that were changed.
2 Security Audit any user-initiated security event for all management
interfaces. For events that have an impact on an entire fabric, an
audit is generated only for the switch from which the event was
initiated.
3 Configuration Audit configuration downloads of existing SNMP configuration
parameters. Configuration uploads are not audited.
4 Firmware Audit firmware download start, firmware complete, and any other
errors encountered during a firmware download.
5 Fabric Audit administrative domain-related changes.
NOTE: Only the active CP can generate audit messages because event classes being audited
occur only on the active CP. Audit messages cannot originate from other blades in a chassis.
AUDIT, <Timestamp>, [<Event ID>], <Severity>, <Event Class>, <User ID>/<Role>/<IP
address>/<Interface>,<Admin Domain>/<Switch name>,<Reserved>,<Event-specific
information>