When Events Are Logged

When Events Are Logged

Introduction

This section describes when each specific event type is logged.

Login Events

Login events are logged at the time of the successful login (just before the user gets the Local> prompt). Unsuccessful login attempts are handled by Kerberos Password Fail, Login Password Fail, or Remote Password Fail events.

Logout Events

Logout events are stored when the port is logged out. There is always an associated login event.

Session Connect Attempt Events

Session connect attempt events are stored when a session connect is being attempted (either user-initiated or dedicated). All attempts are logged whether they are successful or not.

Session Disconnect Events

Session disconnect events are logged when a session connect attempt fails or when an existing session is terminated. There is always an associated session connect attempt event. Use the disconnect reason or bytes Tx/Rx to determine whether the connection attempt was successful.

Password Fail Events

Password fail (Kerberos, Privilege, Maintenance, Login, Remote) events are logged for every attempt to enter the associated password.

SNMP Community Fail Events

SNMP community fail events are logged whenever an SNMP access attempt is made with a community name and/or source IP address that is not enabled on the access server.

Accounting 23-9