Fabric OS Message Reference v6.4.0 (53-1001767-01, June 2010)

10 Fabric OS Message Reference
53-1001767-01
Reading a RAS System Message
1
Audit Event Messages
Compared to RASLog error messages, messages flagged as AUDIT provide additional user and
system-related information of interest for post event auditing and problem determination.
Audit event message format:
AUDIT, <timestamp>, [<Event ID>], <Severity>, <Event Class>, <User
ID>/<Role>/<IP address>/<Interface>/<app name>. <Admin Domain>/<Switch name>,
<Reserved field for future expansion>, <Event-specific information>
The following is a sample audit event message:
AUDIT, 2005/12/10-09:54:03, [SEC-1000], WARNING, SECURITY,
JohnSmith/root/192.168.132.10/Telnet/CLI, Domain A/JohnsSwitch, , Incorrect
password during login attempt.
The fields in the error message are described in Table 4.
TABLE 4 Audit Message Field Description
Example Variable Name Description
AUDIT Audit flag Identifies the message as an Audit message.
2005/12/10-09:54:03 Date and Time Stamp The system time (UTC) when the message was
generated on the switch. The RASLog subsystem will
support an internationalized timestamp format base
on the “LOCAL” setting.
[SEC-1000] Message Module and
Message Number
The message module and number. These values
uniquely identify each message in the Fabric OS and
reference the cause and actions recommended in this
manual. Note that not all message numbers are used;
there can be gaps in the numeric message sequence.
WARNING Severity Level The severity of the error:
1 = Critical
2 = Error
3 = Warning
4 = Info
SECURITY Event Class The event class:
Zone
Security
Configuration
Firmware
Fabric
JohnSmith User ID The user ID.
root Role The role of the user ID.
192.168.132.10 IP Address The IP address.
Telnet Interface The interface being used.
CLI Application Name The application name being used on the interface.
Domain A Admin Domain The Admin Domain, if there is one.