EVPN Events

Vendor Documentation

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

Classification

Rule Name	Rule Type	Common Event	Classification
EVPN Events	Base Rule	General Information Log Message	Information

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Event ID	<vmid>	Number	Event ID 9501, 9502, 9503, 9504, 9505, 9506, 9507, 9508, 9509, 9510, 9511, 9512, 9513, 9514, 9515, 9516, 9517, 9518
Severity	<severity>	Text/String	For All: Information For 9510, 9511, 9512: Warning
Message	<subject> <object>	Text/String	Event ID 9501: Logs EVPN EVI create event.
	<subject> <object>	Text/String	Event ID 9502: Logs EVPN EVI delete event.
	<subject> <object> <objectname>	Text/String	Event ID 9503: Logs EVPN RD update event for an EVI.
	<subject> <object>	Text/String	Event ID 9504: Logs EVPN RD delete event for an EVI.
	<subject> <object> <objectname>	Text/String	Event ID 9505: Logs EVPN RT create event for an EVI.
	<subject> <object> <objectname>	Text/String	Event ID 9506: Logs EVPN RT delete event for an EVI.
	<subject> <object> <objectname>	Text/String	Event ID 9507: Logs EVPN RT update event for an EVI.
	<subject> <object> <dip>	Text/String/IP Address	Event ID 9508: Logs EVPN VTEP VNI add event.
	<subject> <object> <dip>	Text/String/IP Address	Event ID 9509: Logs EVPN VTEP VNI delete event.
	<subject> <action> <dmac> <dip>	Text/String/IP Address	Event ID 9510: Logs EVPN static MAC conflict event.
	<subject> <action> <dmac>	Text/String/Number	Event ID 9511: Logs EVPN static MAC conflict event.
	<subject> <action> <dmac>	Text/String/Number	Event ID 9512: Logs EVPN duplicate MAC dampening event.
	<subject> <object>	Text/String	Event ID 9513: Logs EVPN VRF create event.
	<subject> <object>	Text/String	Event ID 9514: Logs EVPN VRF delete event.
	<subject> <objectname> <object>	Text/String	Event ID 9515: Logs EVPN VRF RD update event.
	<subject> <objectname> <object>	Text/String	Event ID 9516: Logs EVPN VRF RT create event.
	<subject> <objectname> <object>	Text/String	Event ID 9517: Logs EVPN VRF RT delete event.
	<subject> <objectname> <object>	Text/String	Event ID 9518: Logs EVPN VRF RT update event.