IPv6 Router Advertisement Events

Vendor Documentation

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

Classification

Rule Name	Rule Type	Common Event	Classification
IPv6 Router Advertisement Events	Base Rule	General Information Log Message	Information

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Event ID	<vmid>	Number	Event ID 3901, 3902, 3903, 3904, 3905, 3906, 3907, 3908, 3909, 3910, 3911, 3912, 3913, 3914, 3915, 3916, 3917, 3918, 3919
Severity	<severity>	Text/String	For All: Information
Message	<subject> <dinterface>	Text/String	Event ID 3901: Event raised when ipv6 ra enabled
	<subject> <dinterface>	Text/String	Event ID 3902: Event raised when ipv6 ra disabled
	<subject> <dinterface>	Text/String	Event ID 3903: Event raised when ipv6 ra suppress mtu is configured
	<subject> <dinterface>	Text/String	Event ID 3904: Event raised when ipv6 ra suppress mtu configured
	<subject> <dinterface>	Text/String	Event ID 3905: Event raised when ipv6 ra suppress rdnss is configured
	<subject> <dinterface>	Text/String	Event ID 3906: Event raised when ipv6 ra suppress rdnss is removed
	<subject> <dinterface>	Text/String	Event ID 3907: Event raised when ipv6 ra suppress dnssl is configured
	<subject> <dinterface>	Text/String	Event ID 3908: Event raised when ipv6 ra suppress dnssl is removed
	<subject> <dinterface>	Text/String	Event ID 3909: Event raised when ipv6 ra interface is added
	<subject> <dinterface>	Text/String	Event ID 3910: Event raised when ipv6 ra interface is deleted
	<subject> <dinterface> <dip>	Text/String/IP Address	Event ID 3911: Event raised when ipv6 address is added on interface
	<subject> <dinterface> <dip>	Text/String/IP Address	Event ID 3912: Event raised when ipv6 address is deleted from interface
	<subject> <dinterface>	Text/String	Event ID 3913: Event raised when RA Prefix is added on interface
	<subject> <dinterface>	Text/String	Event ID 3914: Event raised when RA Prefix is deleted from interface
	<subject> <dinterface>	Text/String	Event ID 3915: Event raised when default prefix is configured
	<subject> <dinterface>	Text/String	Event ID 3916: Event raised when RDNSS is added
	<subject> <dinterface>	Text/String	Event ID 3917: Event raised when RDNSS is deleted
	<subject> <dinterface>	Text/String	Event ID 3918: Event raised when DNSSL is added
	<subject> <dinterface>	Text/String	Event ID 3919: Event raised when DNSSL is deleted