Concept Guide

• Disable console logging.
CONFIGURATION mode
no logging console
Audit and Security Logs
This section describes how to congure, display, and clear audit and security logs.
The following is the conguration task list for audit and security logs:
• Enabling Audit and Security Logs
• Displaying Audit and Security Logs
• Clearing Audit Logs
Enabling Audit and Security Logs
You enable audit and security logs to monitor conguration changes or determine if these changes aect the operation of the system in the
network. You log audit and security events to a system log server, using the logging extended command in CONFIGURATION mode.
Audit Logs
The audit log contains conguration events and information. The types of information in this log consist of the following:
• User logins to the switch.
• System events for network issues or system issues.
• Users making conguration changes. The switch logs who made the conguration changes and the date and time of the
change. However, each specic change on the conguration is not logged. Only that the conguration was modied is logged with the
user ID, date, and time of the change.
• Uncontrolled shutdown.
Security Logs
The security log contains security events and information. RBAC restricts access to audit and security logs based on the CLI sessions’ user
roles. The types of information in this log consist of the following:
• Establishment of secure trac ows, such as SSH.
• Violations on secure ows or certicate issues.
• Adding and deleting of users.
• User access and conguration changes to the security and crypto parameters (not the key information but the crypto conguration)
Important Points to Remember
When you enabled RBAC and extended logging:
• Only the system administrator user role can execute this command.
• The system administrator and system security administrator user roles can view security events and system events.
• The system administrator user roles can view audit, security, and system events.
• Only the system administrator and security administrator user roles can view security logs.
• The network administrator and network operator user roles can view system events.
72
Management