HP StorageWorks 1606 Brocade Fabric OS Message Reference v6.3.0 (53-1001338-01 - Page 72

1 Overview of System Messages • Trace dump, first-time failure detection capture (FFDC), and core dump files can be uploaded to the FTP server using the supportSave command. • It is recommended to configure the syslogd facility as a management tool for error logs. This is particularly important for dual-domain switches because the syslogd facility saves messages from two logical switches as a single file and in sequential order. See "System Logging Daemon (syslogd)" on page 3 for more information. Event Auditing Event auditing is designed to support post-event audits and problem determination based on high-frequency events of certain types such as security violations, zoning configuration changes, firmware downloads, and certain types of fabric events. Fabric OS versions earlier than v5.2.0 generated a subset of messages flagged as AUDIT in the RASLog to identify some of this type of output in addition to error log messages. In Fabric OS v5.2.0 and later, messages flagged as AUDIT are no longer saved in the switch's error logs. Instead, the switch can be configured to stream Audit messages to the switch console and to forward the messages to specified syslog servers. There is no limit to the number of audit events. For any given event, AUDIT messages capture the following information: • User Name - The name of the user who triggered the action. • User Role - The access level of the user, such as, root or admin. • Event Name - The name of the event that occurred. • Status - The status of the event that occurred: success or failure. • Event Info - Information about the event. The five event classes described in the following table can be audited. TABLE 1 Operand Event Class Description 1 Zone You can audit zone event configuration changes, but not the actual values that were changed. For example, you may receive a message that states "Zone configuration has changed," but the message does not display the actual values that were changed. 2 Security You can audit any user-initiated security event for all management interfaces. For events that have an impact on the entire fabric, an audit is only generated for the switch from which the event was initiated. 3 Configuration You can audit configuration downloads of existing SNMP configuration parameters. Configuration uploads are not audited. 4 Firmware You can audit configuration downloads of existing SNMP configuration parameters. Configuration uploads are not audited. 5 Fabric You can audit Administration Domain related changes. Fabric OS v6.1.1 generates the following component-specific Audit messages: • AG-related messages: AG 1029 • Authentication messages: AUTH 3001-3008 • Configuration messages: CONF-1000, 1020, 1022 2 Fabric OS Message Reference 53-1001338-01