HP NonStop SSH 544701-014

HP NonStop SSH Reference Manual Monitoring and Auditing • 291
Event
Id
Event
Name
Conditions Pattern Token Values
16 PtyEvent Successful
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘ptyallocate’
%object: pty name
%outcome: ‘granted’
Failed
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘ptyallocate’
%object: (empty)
%outcome: ‘denied’ or ‘failed’
17 ShellEvent
No forced
command
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘shell’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
Forced
command
"%sessionId: %user@%remoteAddress
%action %object %outcome (forced
command: %forcedcommand)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘shell’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
%forcedCommand: forced
command
18 ExecEvent
No forced
command
"%sessionId: %user@%remoteAddress
%action %object %outcome"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘exec’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
Forced
command
"%sessionId: %sessionId:
%user@%remoteAddress %action
%object %outcome (forced command:
%forcedcommand)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘exec’
%object: shell program
%outcome: ‘granted’, ‘denied’ or
‘failed’
%forcedCommand: forced