User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
168
4.7 Remote Audit Logging
When remote audit logging is enabled, the Mesh Point sends
audit log messages of the specified severity level (and higher)
to the configured external syslog server (Section 4.7.1). Audit-
logged administrative and device activity can then be
separately filtered by a number of additional parameters
(Sections 4.7.2 and 4.7.4).
4.7.1 Enabling Audit Logging
View the audit logging and syslog server settings currently in
effect with
show logging:
> show logging
EnableAuditMode: Y
Severity: critical
EnableRemote: N
RemoteHost:
Common Criteria Auditing: N
NOTE: Audit log
messages are iden-
tified as such in the local
event log, but remote
log filtering functions
have no effect on local
event logging.
By default, no external syslog server is configured for the Mesh
Point. To send log messages from the Mesh Point to an
external audit log, you must enable and configure the
connection to the syslog server.
You can also specify the severity level at and above which log
messages are sent to the configured server. By default, only
messages of
critical or greater severity are forwarded to the
audit log.
You can also enable Common Criteria audit logs which may
impact performance or throughput. These logs include per-
interface packet filtering logs and logs reporting traffic drops
due to excessive traffic on an interface.
# set logging
EnableAuditMode[Y] (Y|N to enable logging audit mode):
Severity[info] (emergency|alert|critical|error|warning|notice|info):
EnableRemote[N] (Y|N to enable remote logging): y|n
RemoteHost[""] (Name or IP address of remote logging host):
<IPaddr> | <hostname>
EnableCCAudit[N] (Y|N to enable Common Criteria audit logging):
You must be logged on to an administrator -level account to
configure audit logging (refer to Section 2.2).
4.7.2 Globally Filtering Audited Administrative
Activity
NOTE: Changes to
administrative
audit logging take effect
at the next administra-
tor logon.
When remote audit logging is enabled, you can filter audited
administrative activity globally, by a number of parameters.
Globally configured audit-log filters apply only to the activity of
administrative accounts with an
-audit setting of automatic
(Section 2.2.3) and only when the administrator’s MAC
address is not subject to conflicting audit-log settings (Section