NDM Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

NDM Events

Base Rule

General Information Log Message

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 6101, 6102, 6103, 6104, 6105, 6106, 6107, 6108, 6109, 6110, 6111, 6112, 6113, 6114, 6115, 6116, 6117, 6118, 6119, 6120, 6121, 6122, 6123, 6124, 6125, 6126, 6127, 6128, 6129, 6130, 6131, 6132, 6133, 6134

Severity

<severity>

Text/String

For All: Information
For 6121, 6122, 6123, 6132, 6133, 6134: Error

Message

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6101:
Static neighbor created

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6102:
Static neighbor deleted

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6103:
Static neighbor modified

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6104:
IPDB neighbor added to the neighbor Table

<subject>
<sip>

Text/String/IP Address

Event ID 6105:
IPDB neighbor deleted from the neighbor Table

<subject>
<dport>
<object>

Text/String/Number

Event ID 6106:
Clear all arp entries requested on Specific Port

<subject>
<dport>
<object>

Text/String/Number

Event ID 6107:
Clear all VSX Peer ARP entries requested on Specific Port

<subject>
<object>

Text/String

Event ID 6108:
Clear all arp entries requested on Specific VRF

<subject>
<object>

Text/String

Event ID 6109:
Clear all VSX Peer arp entries requested on Specific VRF

<subject>

Text/String

Event ID 6110:
Clear all arp entries requested

<subject>

Text/String

Event ID 6111:
Clear all VSX Peer arp entries requested

<subject>
<sip>
<sport>
<object>

Text/String/IP Address/Number

Event ID 6112:
EVPN Virtual Tunnel EndPoint Neighbor added to the neighbor table

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6113:
EVPN Virtual Tunnel EndPoint Neighbor Updated in the neighbor table

<subject>
<sip>
<sport>
<object>

Text/String/IP Address/Number

Event ID 6114:
EVPN VTEP Neighbor deleted from the neighbor table

<subject>
<object>

Text/String

Event ID 6115:
Processing Redundancy management

<subject>

Text/String

Event ID 6116:
Management role changed to new role

<subject>
<dport>

Text/String/Number

Event ID 6117:
IPv4 neighbor ageout time changed to new value

<subject>
<dport>

Text/String/Number

Event ID 6118:
IPv6 neighbor ageout time changed to new value

<subject>

Text/String

Event ID 6119:
VSX neighbor datapath init sync status is enabled

<subject>

Text/String

Event ID 6120:
VSX neighbor datapath init sync status is disabled

<subject>
<dip>

Text/String/IP Address

Event ID 6121:
Static Neighbor add failed, subnet not matched

<subject>
<dip>

Text/String/IP Address

Event ID 6122:
Static Neighbor add failed, it is own ip

<subject>
<dip>

Text/String/IP Address

Event ID 6123:
Static Neighbor add failed, port is down

<subject>

Text/String

Event ID 6124:
Neighbor table VSX peer DB connection terminated

<subject>

Text/String

Event ID 6125:
Neighbor table VSX peer DB connection established

<subject>
<dip>
<object>
<dport>

Text/String/IP Address/Number

Event ID 6126:
VSX Peer IP added in port vsxPeerIpCache

<subject>
<dip>
<object>
<dport>

Text/String/IP Address/Number

Event ID 6127:
VSX Peer IP deleted in port vsxPeerIpCache

<subject>
<dport>

Text/String/Number

Event ID 6128:
Proxy arp enabled for the given interface

<subject>
<dport>

Text/String/Number

Event ID 6129:
Proxy arp diabled for the given interface

<subject>
<sip>
<sport>
<object>
<smac>

Text/String/IP Address/Number

Event ID 6130:
Neighbor modified

<subject>

Text/String

Event ID 6131:
Neighbor Discovery daemon started

<subject>
<dip>
<dport>
<dmac>

Text/String/IP Address/Number

Event ID 6132:
Duplicate IP detected from ARP reply

<subject>
<dip>
<dport>
<dmac>

Text/String/IP Address/Number

Event ID 6133:
Duplicate IPv6 address detected from Neighbour advertisement

<subject>
<dip>
<dport>
<dmac>

Text/String/IP Address/Number

Event ID 6134:
Duplicate IP detected from ARP request