Audit log header format (RFC3164-compliant)

System Administrator Guide for VSP One Block 85

Version

A0-05-4x

Audience

anonymous

Part Number

MK-26VSP1B030-03

ft:lastEdition

2026-06-22

No.	Item	Description
1	Priority	The priority value given by the following formula is output, enclosed by < >. Priority value = 8 x Facility + Severity Facility is 17 (Fixed value). Severity takes the following values, depending on the type of the log information: 4: Error (Abnormal end) or Warning (The operation partly ended abnormally or was aborted.) 6: Informational (Normal end) For example, if Severity is Error, <140> is output for the priority value.
2	Date, time¹	The date and time are output in the format of MMM DD HH:MM:SS. (MMM: month, DD: day, HH: hour, MM: minute, SS: second) The abbreviation of months (Jan to Dec) is output to MMM. For the first to ninth day of a month, a space followed by the day is output to DD. For example, if it is the first day of a month, the output is " 1".
3	Detected location	"ESM" is output for a host name.
4	Program name	"Storage" is output for the detection entity identifier.
5	Unified specification identification	"CELFSS" is output for the unified specification identifier.
6	Unified specification identification	"1.1" is output for the revision number of the unified specification.
7	Message identification	The serial number of the syslog header information is output.
8	Message identification	Message ID (No output because it is unused.)
9	Date, time#2¹	The date, time, and the time difference from UTC (Universal Time Coordinated) are output in the format of YYYY-MMDDThh: mm:ss.s ±hh:mm. (YYYY: year, MM: month, DD: day, hh: hour, mm: minute, ss.s: second, hh: hour of the time difference, mm: minute of the time difference). However, if there is no time difference from UTC, "Z" is output for "±hh:mm" such as 2016-12-T23:06:58.0Z. "ss.s" (Output format of second) means the first decimal point is output.
10	Detection entity	"Storage" is output for the detection entity identifier.
11	Detected location	"ESM" is output as a host name.
12	Type of audit event	The category name of the audit event is output. The actual category names and examples of the events are as follows: Authentication: Authentication etc. to RMI ConfigurationAccess: Configuration from Maintenance PC, hosts, CCI, or VSP One Block Administrator. Maintenance: Configuration on Maintenance PC ExternalService: Remote maintenance operation StartStop: Start or stop of hardware or software LinkStatus: Link status between devices
13	Result of audit event	The result of the audit event is output as follows. Success: Normal start (the operation started normally) or normal end (the operation ended normally) Failed: Error (xxxxx-yyyyyy) (The operation ended abnormally.) Failed: Warning (xxxxx-yyyyyy) (The operation partly ended abnormally or was aborted.) "xxxxx-yyyyyy" shows an error code. This error code is not shown in the result of the audit event if the operation is performed from Maintenance PC or by the command from a host.
14	Subject identification	The user name is output in the format of "uid=user name".^{2, 3} If the audit log is output due to a cause other than user operations, one of the following is displayed: uid=<DKCMaintenance>: Operation from Maintenance PC uid=<Host>: Command from a host uid=<system>: Internal operation of the storage system
15	Hardware identification	The ID that identifies the model name of the product and the serial number (five digit number) are punctuated with a colon (:) and output (for example, "VSP One B85:12345").
16	Generated location	No output because it is unused.
17	Related information	The location identification name configured in the Set Up Syslog Server for Audit Logs window is output.
18		FQDN (No output because it is unused.)
19		Redundancy identification information (No output because it is unused.)
20	Agent information	No output because it is unused.
21	Host identification	The identification information of a host sending requests is output as follows. Operations of VSP One Block Administrator: IP addresses of ESM (IPv4 or IPv6) CCI operation A host name is output for authenticated hosts. A WWN is output for unauthenticated hosts. IP addresses of ESM are output if operations are performed from CCI of the embedded CLI. An IP address is output for the CHAP authentication. No output for event logs caused by internal operations of the storage system.
22	Request information	The port that sends requests (No output because it is unused.)
23		The host that receives requests (No output because it is unused.)
24		The port that receives requests (No output because it is unused.)
25	Collective operation identifier	The collective operation identifier is a serial number with which the operation is recognized as one operation even if it outputs multiple lines.
26	Log type information	The log type information is output as follows: BasicLog: Basic information DetailLog: Detailed information
27	Application identification	When commands are received from a host, the following are output. ID that the host and storage system use internally 0x0000: When receiving commands from other storage systems. No output for events on CHAP, Computers using CCI, or encryption keys.
28	Reserve	Reserve #2 (No output because it is unused.)
Notes: If a LAN failure etc. occurs on the storage system, the date and time might be the accumulated time since January 1, 1970. The end of the name might be [UserSpecifiedValue] if the operation is performed from RMI AP. If [UserSpecifiedValue] is displayed, the IP address or user ID specified by the client is output. uid=<not specified> is output if the user name is not recognized before login.