Lenovo ThinkSystem NE2552E, Application Manual

Page: 483 / 574

© Copyright Lenovo 2018 Chapter 34: Simple Network Management Protocol
483
Secure Audit Logging
Flex System managers may use the authentication and encryption protocols of
SNMPv3 to securely audit the switch. The audit logs record activity and severity
for the overall system, user, and application processes. These logs can be used to
trace a user ʹ s actions, monitor switch alerts, and confirm intrusion detection.
Networking OS uses SNMPv3 authorization to forward the logs securely to the
management tool via the chassis management module (CMM). The switch
supports both retrieving the logs via SNMP ʹ Get ʹ requests and the forwarding of
event logs via SNMP traps. Supported management tools are xHMC and other
(security and information event management) SIEM tools like Qradar.
Security audit logging refers to the following event types:
 NTP Server/DHCP server configuration changes
 Switch management IP address changes
 OSPF/BGP/RIP authentication changes
 Software Resource alert :ARP Table/IP table/Route table/OSPF table full
 L3 Link down/up
Note:
Audit logging is enabled by default and cannot be disabled. The audit logs
are accessed remotely via SNMPv3 hosts.
Use the following commands to locally manage the logs:
NE2552E(config)# show sal reverse
(Display most recent logs first)
NE2552E(config)# clear sal
(Clear audit logs)