HP StorageWorks 1606 Brocade Fabric OS Administrator's Guide v6.3.0 (53-100133 - Page 89

Audit log configuration 2 • If too many events are generated by the switch, the system message log becomes a bottleneck and audit events are dropped by the Fabric OS. • If the user name, IP address, or user interface is not transported, an audit message is logged by adding the message None to each of the respective fields. • For High Availability, the audit event logs exist independently on both active and standby CPs. The configuration changes that occur on the active CP are propagated to the standby CP and take effect. • Audit log configuration is updated through a configuration download. Auditable event classes Before configuring an audit log, you must select the event classes you want audited. The audit log includes: • SEC-3001 through SEC-3017 • SEC-3024 through SEC-3029 • ZONE-3001 through ZONE-3012 Table 6 identifies auditable event classes and the auditCfg command operands used to enable auditing of a specific class. TABLE 6 AuditCfg event class operands Operand Event class Description 1 Zone Audit zone event configuration changes, but not the actual values that were changed. For example, a message may state, "Zone configuration has changed," but the syslog does not display the actual values that were changed. 2 Security Audit any user-initiated security events for all management interfaces. For events that have an impact on an entire fabric, an audit is generated only for the switch from which the event was initiated. 3 Configuration Audit configuration downloads of existing SNMP configuration parameters. Configuration uploads are not audited. 4 Firmware Audit firmware download start, firmware complete, and any other errors encountered during a firmware download. 5 Fabric Audit administrative domain-related changes. NOTE Only the active CP can generate audit messages because event classes being audited occur only on the active CP. Audit messages cannot originate from other blades in an enterprise-class platform. Audit events have the following message format: AUDIT, , [], , , ///,/,, Switch names are logged for switch components and enterprise-class platform names for enterprise-class platform components. For example, an enterprise-class platform name may be FWDL or RAS and a switch component name may be zone, name server, or SNMP. Fabric OS Administrator's Guide 47 53-1001336-01