Breadcrumbs

AAA Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

AAA Events

Base Rule

General AAA Message

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 2301, 2302, 2303, 2304, 2305

Severity

<severity>

Text/String

For All: Information

Message

<subject>
<objecttype>
<object>

Text/String

Event ID 2301:
Logs AAA Authentication/Authorization/Accounting/fail-through

 

<subject>
<objecttype>
<action>
<object>

Text/String

Event ID 2302:
Logs TACACS+ server update, server group update and global default update

 

<subject>
<objecttype>
<action>
<object>

Text/String

Event ID 2303:
Logs RADIUS server update, server group update and global default update

 

<subject>
<dip>
<dport>
<object>
<status>

Text/String/Number/IP Address

Event ID 2304:
Logs changes in RADIUS server reachability status

 

<subject>
<dip>
<dport>
<object>
<status>

Text/String/Number/IP Address

Event ID 2305:
Logs changes in TACACS server reachability status