Fidelis Network Common Criteria Configuration Guide Version 9.0.3
10
www.fidelissecurity.com
If a system daemon fails to start for other reasons than integrity check failure, the event will be logged in
/var/log/messages
. Depending on the daemon and the reason for its failure, more detailed
information may be found in the corresponding log in /FSS/log/.
Audit Events
The table below lists and describes applicable audit events and administrative actions for each of the
security functional requirements (SFRs) covered by Common Criteria.
The general order of the audit events is as follows:
1.
Date.
2.
Time.
3.
TOE Component IP address.
4.
TOE Component name (hostname).
5.
Process name or audit function name (e.g. FSS audit).
6.
Process ID (optional).
7.
Audit event description string. This is specific to audit event type.
See the table below for examples and details.
Table 2. SFRs and Auditable Events
SFR
Event
Additional
Information
Sample Log
FAU_GEN.1 Start-up of audit
functions
None
Sep 8 11:38:12 10.42.212.199 localhost
syslog-ng[2368]: syslog-ng starting up;
version='3.7.3'
Sep 8 14:25:43 localhost FSS
audit[2423]: System startup
Shutdown of audit
functions
None
Sep 8 11:34:59 10.42.212.199 04
localhost syslog-ng[2369]: syslog-ng
shutting down; version='3.7.3'
Sep 8 14:23:17 localhost FSS
audit[4273]: System shutdown
FCO_CPC_
EXT.1
Enabling
communications
between a pair of
components.
Disabling
communications
between a pair of
components.
Identity and
type of TOE
component
being
registered or
unregistered.
Identities of
the TLS
endpoints
involved in
the
transaction.
Sep 7 16:47:22 localhost FSS
audit[70423]: admin registered Sensor
linux90col Type: metadatav
Sep 7 16:47:22 localhost FSS
audit[70437]: Sensor <linux90col> TLS
SUCCESS: Local: localhost, Remote:
10.89.184.31
Sep 7 16:47:23 localhost FSS
audit[70441]: Sensor <linux90col>
sensor registered successfully
FCS_HTTPS Failure to establish a Reason for
Mar 17 10:01:51 10.42.209.241 FSS:
