Формат syslog-сообщений (системный аудит)

Формат сообщений, отправляемых по syslog для событий системного аудита, приведен в таблице ниже.

ПолеЗначениеПоле-источник из событий аудита

Version

0

-

Device Vendor

<event.Vendor>

vendor

Device Product

<event.Product>

product

Device Version

<event.ProductVersion>

product_version

DeviceEventClassId

<event.Type>

action_type

Name

<event.Action>

action

Severity

<event.Severity::string, 0-6 (Lowest-SuperCritical)>

severity

ПолеTypeЗначениеПоле-источник из событий аудита

сommon

start

datetime

<event.Time>

time

description

string

<event.Code::string>-<event.Type>-<event.Action>

action_code, action_type, action

msg

string

<event.Message>

action_message

rawEvent

string

<json.Marshal(*event)::string>

всё событие (event)

eventId

string

<event.Action>

action

level

number

<event.Severity, 0-6 (Lowest-SuperCritical)>

severity

cs1Label

string

instance_id

-

cs1

string

<event.InstanceID>

instance_id

result

cs2Label

string

result_ok

-

cs2

string

<event.ResultOK::string>

result_ok

cs3Label

string

result_summary

-

cs3

string

<event.ResultSummary>

result_summary

cs4Label

string

result_details

-

cs4

string

<event.ResultDetails>

result_details

source

shost

string

<event.SourceAddress>

source_address

sourceDnsDomain

string

<event.SourceDomain>

source_domain

sourceServiceName

string

<event.SubjectID>

subject_id

cs5Label

string

subject

-

cs5

string

<event.SubjectType>-<event.SubjectID>

subject_type, subject_id

src

string

<event.SourceIP>

source_ip

destination

dhost

string

<event.TargetIP>

target_ip

destinationDnsDomain

string

<event.TargetDomain>

target_domain

cs6Label

string

target

-

cs6

string

<event.TargetType>-<event.TargetID>

target_type, target_id

dst

string

event.TargetIP

target_ip

component info

cs7Label

string

component_name

-

cs7

string

<event.ComponentName>

component_name

cs8Label

string

component_ip

-

cs8

string

<event.ComponentIP>

component_ip

cs9Label

string

component_domain

-

cs9

string

<event.ComponentDomain>

component_domain

cs10Label

string

component_address

-

cs10

string

<event.ComponentAddress>

component_address

cs11Label

string

component_version

-

cs11

string

<event.ComponentVersion>

component_version