User's Manual 800 Document #: LTRT-89730
Mediant 3000
The Messages’ Severity is as follows:
Table 53-5: Syslog Message Severity
ITU Perceived Severity
(SNMP Alarm’s Severity)
AudioCodes' Syslog Severity
Critical
RecoverableMsg
Major
RecoverableMsg
Minor
RecoverableMsg
Warning
Notice
Indeterminate
Notice
Cleared
Notice
Cleared Alarms: CLEAR-ALARM: <Alarm Name>; Textual Description: <Textual
Description>; Severity <Alarm Severity>; Source <Alarm Source>; Unique ID: <Alarm
Unique ID >; If exists Additional Info1:/ Additional Info2:/ Additional Info3:
53.2.2 Configuring Web User Activities to Report to Syslog
The device can report operations (activities) performed in the Web interface by
management users, by including them in Syslog messages. The Syslog message indicates
these logs with the string, "Activity Log". Each logged user activity includes the following
information:
Username (e.g., "Admin") of the user that performed the action
IP address of the client PC from where the Web user accessed the management
interface
Protocol used for the session (e.g., SSH or HTTP)
The following example shows a Web-user activity log (indicating a login action) with the
above-mentioned information:
14:07:46.300 : 10.15.7.95 : Local 0 :NOTICE : [S=3149]
[BID=3aad56:32] Activity Log: WEB: Successful login at
10.15.7.95:80. User: Admin. Session: HTTP (10.13.22.54)
The device can report the following Web user activities:
Modifications of individual parameters, for example:
14:33:00.162 : 10.15.7.95 : Local 0 :NOTICE : [S=3403]
[BID=3aad56:32] Activity Log: Max Login Attempts was changed
from '3' to '2'. User: Admin. Session: HTTP (10.13.22.54)
Modifications of table fields, and addition and deletion of table rows, for example:
14:42:48.334 : 10.15.7.95 : NOTICE : [S=3546] [BID=3aad56:32]
Activity Log: Classification - remove line 2. User: Admin.
Session: HTTP (10.13.22.54)
Entered CLI commands (modifications of security-sensitive commands are logged
without the entered value).
Configuration file load (reported without per-parameter notifications).
Auxiliary file load and software update.
Device reset and burn to flash memory.
Access to unauthorized Web pages according to the Web user's access level.
Modifications of "sensitive" parameters.