
Oracle SBC Security Guide
Appendix I: Syslog
The SBC can be configured to send system event logs to logging servers [1]. It is recommended to
configure as few logging servers as required to reduce impact on SBC performance. Monitoring via
SNMP is the preferred option over using syslog. The syslog messages aren’t as efficient since they may
contain many extraneous informational messages that need to be filtered out or parsed. SNMP on the
other hand has the advantage of sending clearly defined trap notifications only in the event of a problem,
and the system-config and trap-receiver settings can be configured to filter on specific SNMP traps to
send.
If a syslog parser is used to escalate SBC issues, it is easy to classify syslog events preceded with a
MAJOR or CRITICAL designation as issues that require further investigation. However, be cautious of
writing any parsing rules for events that are classified as GENERAL, REDUNDANCY, CONFIG
WARNING, ERROR, or MINOR (among others). Some of these may be important to escalate, but others
may be strictly informational in nature.
The table below represents a sample of some of the common syslog messages that may be seen. Note that
IDS_LOG examples given require the IDS Reporting Feature Group license discussed in Section 0. Some
of the examples may seem redundant. This is because in some cases more than one message may be
written to syslog as a result of an event.
A failed login attempt was detected
on the console port.
May 3 17:06:10 172.41.3.90 CSE-4500-20
acliConsole[31ac9b6c] AUTH
authenticate_locally: Authentication failed
for user user
OR
Mar 20 10:27:24.119 acliConsole@: AUTH[53]
authenticate_locally: Authentication failed
for user user
OR
May 3 17:06:10 172.41.3.90 CSE-4500-20
acliConsole[31ac9b6c] WARNING login
authentication failure from acliConsole
A failed login attempt was detected
over telnet, SSH or FTP. See the
process information for further
details.
Dec 18 13:39:44.121 acliTelnet0@SBC1: WARNING
authentication failure for admin from
acliTelnet0
Comentarios a estos manuales