Failed login attempts
Log text User {user name} account is locked for {time} minutes after {failed login count}
unsuccessful login attempts.
Standard IEC 62443-3-3 Reference: SR1.11
Description If there are too many failed logins, the corresponding user account was locked for
a specific period of time.
Example User admin account is locked for 10 minutes after 30 unsuccessful login attempts.
Severity Warning
Facility local0
Access via untrusted networks (IPsec)
Log text [IKE] <{connection name}|{config detail}> IKE_SA {connection name}[{config de‐
tail}]
established between {ip address}[{config detail}]...{ip address}[{config detail}]
Standard IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Description VPN connection established. (IPsec)
Example [IKE] <c1|3> IKE_SA c1[1] established between 192.168.55.210[lokal]..
192.168.55.211[remote]
Severity Info
Facility local0
Log text [IKE] <{connection name}|{config detail}> deleting IKE_SA {connection name}
[{config detail}] between {ip address}[{config detail}]...{ip address}[{config detail}]
Standard IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Description VPN tunnel is closed. (IPsec)
Example [IKE] <c1|3> deleting IKE_SA c2[1] between
192.168.55.211[lokal].. 192.168.55.210[remote]
Severity Info
Facility local0
Log text [IKE] <{connection name}|{config detail}> received AUTHENTICATION_FAILED
notify error
Standard IEC 62443-3-3 Reference: n/a (NERC CIP 005-R3)
Description Authentication of VPN connection failed (IPsec).
Example [IKE] <c1|1> received AUTHENTICATION_FAILED notify error
Severity Warning
Facility local0
Access via untrusted networks (OpenVPN)
Log text OVPN_{connection name}[{config detail}]: Initialization Sequence Completed
Standard IEC 62443-3-3 Reference: n/a (NERC CIP 005-R1)
Appendix A
A.3 Syslog messages
SCALANCE S615 Web Based Management
Configuration Manual, 11/2019, C79000-G8976-C388-08 309