Cisco Systems OL-24201-01 manual 19-6

Chapter 19 Understanding Logging

About Logging

Table 19-2	Local Store and Syslog Message Format
Field		Description
timestamp		Date of the message generation, according to the local clock of the
		originating ACS, in the format YYYY- MM-DD hh:mm:ss:xxx +/-zh:zm.
		Possible values are:
		• YYYY = Numeric representation of the year.
		• MM = Numeric representation of the month. For single-digit months (1
		to 9) a zero precedes the number.
		• DD = Numeric representation of the day of the month. For single-digit
		days (1 to 9), a zero precedes the number.
		• hh = The hour of the day—00 to 23.
		• mm = The minute of the hour—00 to 59.
		• ss = The second of the minute—00 to 59.
		• xxx = The millisecond of the second—000 to 999.
		• +/-zz:zz= The time zone offset from the ACS server’s time zone, where
		zh is the number of offset hours and zm is the number of minutes of the
		offset hour, all of which is preceded by a minus or plus sign to indicate
		the direction of the offset.
		For example, +02:00 indicates that the message occurred at the time
		indicated by the time stamp, and on an ACS node that is two hours ahead
		of the ACS server’s time zone.
sequence_num		Global counter of each message. If one message is sent to the local store and
		the next to the syslog server target, the counter increments by 2. Possible
		values are 0000000001 to 999999999.
msg_code		Message code as defined in the logging categories.
msg_sev		Message severity level of a log message (see Table 19-1).
msg_class		Message class, which identifies groups of messages with the same context.
text_msg		English language descriptive text message.
attr=value		Set of attribute-value pairs that provides details about the logged event. A
		comma (,) separates each pair.
		Attribute names are as defined in the ACS dictionaries.
		Values of the Response direction AttributesSet are bundled to one attribute
		called Response and are enclosed in curly brackets {}. In addition, the
		attribute-value pairs within the Response are separated by semicolons. For
		example:
		Response={RadiusPacketType=AccessAccept;
		AuthenticationResult=UnknownUser;
		cisco-av-pair=sga:security-group-tag=0000-00; }

	User Guide for Cisco Secure Access Control System 5.3
19-6	OL-24201-01