Port Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

Port Events

Base Rule

General PORT Message

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 601, 602, 603, 604, 605, 606, 607

Severity

<severity>

Text/String

For All: Information
For 607: Error

Message

<subject>
<result>

Text/String

Event ID 601:
Log when netlink socket creation failed

<subject>
<result>

Text/String

Event ID 602:
Log when netlink socket bind failed

<subject>
<dinterface>

Text/String

Event ID 603:
Log when netlink failed to set mtu for interface

<subject>
<dinterface>
<status>

Text/String

Event ID 604:
Log when netlink failed to change the interface status

<subject>
<policy>

Text/String

Event ID 605:
Unknown internal vlan policy

<subject>
<object>

Text/String

Event ID 606:
Log when allocation failed for internal vlan for port

<subject>
<sip>

Text/String/IP Address

Event ID 607:
Log when a duplicate address is received on a port