audit.log events
audit.log.event
- Severity
-
NOTICE
- Description
-
This message occurs when there is an issue during message auditing. The system recovers by itself.
- Corrective Action
-
(None).
- Syslog Message
-
Auditing error (%s) occurred at %s.
- Parameters
-
error (STRING): Error encountered during message auditing.
time (STRING): Time that this error occurred.
audit.log.file.recovered
- Severity
-
NOTICE
- Description
-
This message occurs when the system recovers a previously deleted log file as part of audit log policy.
- Corrective Action
-
(None).
- Syslog Message
-
Recovered previously deleted audit log file "%s".
- Parameters
-
log_name (STRING): Log file name.
recovered_time (STRING): File recovery timestamp.
audit.log.queue.high
- Severity
-
NOTICE
- Description
-
This message occurs when the syslog queue reaches 75% of its maximum size.
- Corrective Action
-
Verify remote server network reachability and processing performance.
- Syslog Message
-
Log queue for destination %s, protocol %s has exceeded 75%% of capacity. Last audit log was sent successfully at %s, number of pending messages: %d.
- Parameters
-
syslog_dest (STRING): Log forwarding destination for which messages are being dropped.
protocol (STRING): Protocol used for syslog destination.
last_sent (STRING): Time that the audit log was last successfully sent to the syslog destination.
pending_msg (INT): Number of pending messages in queue.
audit.log.queue.overflow
- Severity
-
NOTICE
- Description
-
This message occurs when an internal queue overflow causes the audit logging mechanism to drop messages destined for a particular log forwarding destination.
- Corrective Action
-
Verify remote server network reachability and processing performance.
- Syslog Message
-
Log queue overflowed for destination %s, protocol %s. Current drop count: %ld.
- Parameters
-
syslog_dest (STRING): Log forwarding destination for which messages are being dropped.
protocol (STRING): Protocol used for syslog destination.
drop_count (LONGINT): Number of messages dropped since the last drop was reported.
audit.log.queue.recovered
- Severity
-
NOTICE
- Description
-
This message occurs when the audit logging queue recovers after earlier message drops, and the current queue is less than 75% full.
- Corrective Action
-
(None).
- Syslog Message
-
Log queue recovered for destination %s, protocol %s. Issue start time: %s, end time: %s, total number of drops during this period: %ld.
- Parameters
-
syslog_dest (STRING): Log forwarding destination for which the queue has recovered.
protocol (STRING): Protocol used for the syslog destination.
issue_start_time (STRING): Time that the queue overflowed.
recovered_time (STRING): Time that the queue recovered.
drop_count (LONGINT): Total number of drops since the last time the queue overflowed.
audit.log.rotate.size.limit
- Severity
-
NOTICE
- Description
-
This message occurs when the system rotates a log file that has reached its size limit.
- Corrective Action
-
(None).
- Syslog Message
-
Log file %s has been rotated because size limit %ld was reached.
- Parameters
-
log_name (STRING): Log file name.
max_log_size (LONGINT): Maximum log file size.