EVPN Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

EVPN Events

Base Rule

General Information Log Message

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 9501, 9502, 9503, 9504, 9505, 9506, 9507, 9508, 9509, 9510, 9511, 9512, 9513, 9514, 9515, 9516, 9517, 9518

Severity

<severity>

Text/String

For All: Information
For 9510, 9511, 9512:  Warning

Message

<subject>
<object>

Text/String

Event ID 9501:
Logs EVPN EVI create event.

<subject>
<object>

Text/String

Event ID 9502:
Logs EVPN EVI delete event.

<subject>
<object>
<objectname>

Text/String

Event ID 9503:
Logs EVPN RD update event for an EVI.

<subject>
<object>

Text/String

Event ID 9504:
Logs EVPN RD delete event for an EVI.

<subject>
<object>
<objectname>

Text/String

Event ID 9505:
Logs EVPN RT create event for an EVI.

<subject>
<object>
<objectname>

Text/String

Event ID 9506:
Logs EVPN RT delete event for an EVI.

<subject>
<object>
<objectname>

Text/String

Event ID 9507:
Logs EVPN RT update event for an EVI.

<subject>
<object>
<dip>

Text/String/IP Address

Event ID 9508:
Logs EVPN VTEP VNI add event.

<subject>
<object>
<dip>

Text/String/IP Address

Event ID 9509:
Logs EVPN VTEP VNI delete event.

<subject>
<action>
<dmac>
<dip>

Text/String/IP Address

Event ID 9510:
Logs EVPN static MAC conflict event.

<subject>
<action>
<dmac>

Text/String/Number

Event ID 9511:
Logs EVPN static MAC conflict event.

<subject>
<action>
<dmac>

Text/String/Number

Event ID 9512:
Logs EVPN duplicate MAC dampening event.

<subject>
<object>

Text/String

Event ID 9513:
Logs EVPN VRF create event.

<subject>
<object>

Text/String

Event ID 9514:
Logs EVPN VRF delete event.

<subject>
<objectname>
<object>

Text/String

Event ID 9515:
Logs EVPN VRF RD update event.

<subject>
<objectname>
<object>

Text/String

Event ID 9516:
Logs EVPN VRF RT create event.

<subject>
<objectname>
<object>

Text/String

Event ID 9517:
Logs EVPN VRF RT delete event.

<subject>
<objectname>
<object>

Text/String

Event ID 9518:
Logs EVPN VRF RT update event.