Cisco ASR 1001

Page 49 of 72
Requirement
Auditable
Events
Additional Audit
Record Contents
Sample Record
1/3
0/1
3
11:
04:
43
No
tic
e
132: *Jan 30 2013 05:20:16: %SYS-5-CONFIG_I:
Configured from console by console
1/3
0/1
3
11:
09:
13
De
bu
g
136: *Jan 30 10:54:46.421 IST: crypto_engine: Delete
IPsec SA
1/3
0/1
3
11:
09:
13
De
bu
g
135: *Jan 30 10:54:46.421 IST: crypto engine: deleting
IPsec SA :12
1/3
0/1
3
11:
11:
58
No
tic
e
171: *Jan 30 2013 05:27:31: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:no crypto map
1/3
0/1
3
11:
12:
08
No
tic
e
172: *Jan 30 2013 05:27:42: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:crypto map cc
1/3
0/1
3
11:
11:
58
No
tic
e
171: *Jan 30 2013 05:27:31: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:no crypto map
1/3
0/1
3
11:
12:
08
No
tic
e
172: *Jan 30 2013 05:27:42: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:crypto map cc
1/3
0/1
3
11:
11:
58
No
tic
e
171: *Jan 30 2013 05:27:31: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:no crypto map
1/3
0/1
3
11:
12:
08
No
tic
e
172: *Jan 30 2013 05:27:42: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:crypto map cc
1/3
0/1
3
11:
11:
58
No
tic
e
171: *Jan 30 2013 05:27:31: %PARSER-5-
CFGLOG_LOGGEDCMD: User:console logged
command:no crypto map
FCS_SSHS_EX
T.1
Failure to
establish an SSH
session
Reason for failure.
Failure to establish a SSH Session.
IP address of remote host
Reason for failure.
GENERIC EXAMPLE: Jun 18 2012 11:19:06 UTC:
%SEC_LOGIN-4-LOGIN_FAILED: Login failed
[user: anonymous] [Source: 100.1.1.5] [localport: 22]
[Reason: Login Authentication Failed] at 11:19:06
UTC Mon Jun 18 2012
Establishment of a SSH session
IP address of remote host
Jun 18 2012 11:31:35 UTC: %SEC_LOGIN-5-
LOGIN_SUCCESS: Login Success [user: ranger]