Failed login attempts
Log text
User {user name} account is locked for {time} minutes after {failed login count}
unsuccessful login attempts.
Standard
IEC 62443-3-3 Reference: SR1.11
Description
If there are too many failed logins, the corresponding user account was locked for
a specific period of time.
Example
User admin account is locked for 10 minutes after 30 unsuccessful login attempts.
Severity
Warning
Facility
local0
Access via untrusted networks (IPsec)
Log text
[IKE] <{connection name}|{config detail}> IKE_SA {connection name}[{config de‐
tail}]
established between {ip address}[{config detail}]...{ip address}[{config detail}]
Standard
IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Description
VPN connection established. (IPsec)
Example
[IKE] <c1|3> IKE_SA c1[1] established between 192.168.55.210[lokal]..
192.168.55.211[remote]
Severity
Info
Facility
local0
Log text
[IKE] <{connection name}|{config detail}> deleting IKE_SA {connection name}
[{config detail}] between {ip address}[{config detail}]...{ip address}[{config detail}]
Standard
IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Description
VPN tunnel is closed. (IPsec)
Example
[IKE] <c1|3> deleting IKE_SA c2[1] between
192.168.55.211[lokal].. 192.168.55.210[remote]
Severity
Info
Facility
local0
Log text
[IKE] <{connection name}|{config detail}> received AUTHENTICATION_FAILED
notify error
Standard
IEC 62443-3-3 Reference: n/a (NERC CIP 005-R3)
Description
Authentication of VPN connection failed (IPsec).
Example
[IKE] <c1|1> received AUTHENTICATION_FAILED notify error
Severity
Warning
Facility
local0
Access via untrusted networks (OpenVPN)
Log text
OVPN_{connection name}[{config detail}]: Initialization Sequence Completed
Standard
IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Appendix A
A.3 Syslog messages
SCALANCE S615 Web Based Management
Configuration Manual, 11/2019, C79000-G8976-C388-08
309