HP NonStop SSH 544701-014

292 • Monitoring and Auditing HP NonStop SSH Reference Manual
Event
Id
Event
Name
Conditions Pattern Token Values
command
19
ForwardEv
ent
Direct
"%sessionId: %user@%remoteAddress
%action %object %outcome
(%fromAddr:%fromPort-
>%toAddr:%toPort)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘direct-tcpip’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%fromAdd: from address
%fromPort: from port
%toAdd: to address
%toPort: to port
Not Direct
"%sessionId: %user@%remoteAddress
%action %object %outcome
(%fromAddr:%fromPort->remote,
accepted on %toAddr:%toPort)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘forward-tcpip’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%fromAdd: from address
%fromPort: from port
%toAdd: to address
%toPort: to port
19 ListenEvent
"%sessionId: %user@%remoteAddress
%action %object %outcome (listen on:
%interface:%port)"
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address
%action: ‘forward’
%object: ‘tcpip-forward’
%outcome: ‘granted’ or ‘denied’
or ‘failed’
%interface: local bind address
%port: local port
20
TimeoutEv
ent
"%sessionId: %user@%remoteAddress
%action %object"
%sessionId: SESSION-LOG-ID
%remoteAddress: remote IP
address
%action: ‘idle timeout’
%object: module experiencing
timeout (currently always
‘SFTPSERV’)
21
SftpServerF
atalErrorEv
ent
“%sessionId: %user@%remoteAddress
%action %object error info: '%errInfo',
%processType process %processName
stopping..."
%sessionId: SESSION-LOG-ID
%user: SSH username
%remoteAddress: remote IP
address