Breadcrumbs

Radius Authorization Policy Messages

Vendor Documentation

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

pri_num

N/A

N/A

time

N/A

N/A

IP address/hostname

N/A

N/A

cat_name

N/A

<vendorinfo>

msg_id

N/A

N/A

total_seg

N/A

N/A

seg_num

N/A

N/A

timestamp

N/A

N/A

sequence_num

N/A

N/A

msg_code

<vmid>

<vmid>
<tag1>

msg_sev

<severity>

<severity>

msg_class

N/A

<subject> 

msg_text

N/A

<action> 

Key1

N/A

N/A

Key2

N/A

N/A

ConfigVersionId

<version>

N/A

Device IP Address

<sip>

N/A

UserName

<sname>

<login>

Protocol

<protname>

<protname>

RequestReceivedTime

N/A

N/A

PolicyType

<policy>

N/A

OriginalUserName

<login>

N/A

AcsSessionID

<session>

<session>

SelectedAccessService

<process>

N/A

SelectedAuthorizationProfiles

<action>

N/A

IdentityPolicyMatchedRule

<subject>

N/A

AuthorizationPolicyMatchedRule

<result>

N/A

CPMSessionID

N/A

N/A

ISEPolicySetName

<objectname>

<policy>

IdentitySelectionMatchedRule

N/A

N/A

HostIdentityGroup

<group>

<group>

Name

<object>

N/A

Response

N/A

<result>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1010530

Radius Authorization Policy Messages

Base Rule

RADIUS Access-Reject Received

Information

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1012731

V 2.0 Policy Diagnostics Event

Base Rule

Diagnostic Information

Information

V 2.0 EVID 15001 Adapter Contain Atleast One Val

Sub Rule

Incorrect Database Configuration

Error

V 2.0 EVID 15002 Configured Operator Failed

Sub Rule

Database Configuration Change Failed

Error

V 2.0 EVID 15003 Incorrect Database Configuration

Sub Rule

Incorrect Database Configuration

Error

V 2.0 EVID 15004 Matched Rule

Sub Rule

Matched Rule

Information

V 2.0 EVID 15005 Matched Monitored Rule

Sub Rule

Matched Monitored Rule

Information

V 2.0 EVID 15006 Matched Default Rule

Sub Rule

Matched Default Rule

Information

V 2.0 EVID 15007 Policy Result Type Unmatched

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15008 Evaluating Svc Selection Policy

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15009 Authorization Policy Not Config

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15010 Policy Not Configured

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15011 Authorization Policy Not Config

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15012 Selected Access Service

Sub Rule

Access Service Selected

Information

V 2.0 EVID 15013 Selected Identity Source

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15015 Could Not Find ID Store

Sub Rule

ID Store Not Found

Error

V 2.0 EVID 15016 Selected Authorization Profile

Sub Rule

Authorization Profile Selected

Information

V 2.0 EVID 15017 Selected Shell Profile

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15018 Selected Command Set

Sub Rule

Command Set Selected

Information

V 2.0 EVID 15019 Authorization Profiles Not Find

Sub Rule

Authorization Profiles Not Found

Error

V 2.0 EVID 15020 Shell Profiles Not Find

Sub Rule

Shell Profiles Not Found

Error

V 2.0 EVID 15021 Command Set Not Find

Sub Rule

Command Set Not Found

Warning

V 2.0 EVID 15022 Access Service Not Find

Sub Rule

Access Service Not Found

Error

V 2.0 EVID 15023 Could Not Match Rule

Sub Rule

Rule Not Matched

Information

V 2.0 EVID 15024 PAP Not Allowed

Sub Rule

PAP Not Allowed

Information

V 2.0 EVID 15025 Policy Not Configured

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15026 External Policy Server Not Found

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15027 External Policy Server Selected

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15028 Sending Request To Ext. Server

Sub Rule

Sending Request

Information

V 20 EVID 15029 Attr Not Retrieve Frm Ext Policy

Sub Rule

Attributes Not Retrieved

Error

V 2.0 EVID 15030 Misconfig Of Ext. Policy Server

Sub Rule

Apparent Misconfiguration

Error

V 2.0 EVID 15031 Ext Policy Attributes Retrieved

Sub Rule

Attributes Retrieved

Information

V 2.0 EVID 15032 Evaluating External Policy Check

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15033 Mapping Policy Not Configured

Sub Rule

Policy Not Configured

Error

V 2.0 EVID 15034 Skip External Policy Check

Sub Rule

Policy Check Skipped

Warning

V 2.0 EVID :15035 Evaluating Exception Auth Policy

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15036 Evaluating Authorization Policy

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15037 Access Service

Sub Rule

Access Service Selected

Information

V 2.0 EVID 15038 Skipping External Policy

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15039 Rejected Per Auth. Profile

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15040 Attribute Not Defined Cert.

Sub Rule

Missing Attribute

Warning

V 2.0 EVID 15041 Evaluating Identity Policy

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15042 No Rule Was Matched

Sub Rule

Rule Not Matched

Information

V 2.0 EVID 15043 Attribute Value Unavailable

Sub Rule

Missing Attribute

Warning

V 2.0 EVID 15044 Evaluating Group Mapping Policy

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15045 CHAP Not Allowed

Sub Rule

CHAP Not Allowed

Warning

V2.0 EVID 15046 MS-CHAP V1 Disabled

Sub Rule

Protocol Disabled

Information

V2.0 EVID 15047 MS-CHAP V2 Disabled

Sub Rule

Protocol Disabled

Information

V 2.0 EVID 15048 Queried PIP

Sub Rule

Query Information

Information

V 2.0 EVID 15049 Evaluating Policy Group

Sub Rule

Evaluating Policy

Other Audit

V 2.0 EVID 15050 Dev. Not Support Config Of VLAN

Sub Rule

Caution Message Concerning Vlan Configuration

Information

V 2.0 EVID 15051 Device Not Support Config Of ACL

Sub Rule

Unsupported ACL

Warning

V 2.0 EVID 15052 Authorization Profile Not Suited

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15053 N/W Access Dev. Not Support CoA

Sub Rule

General Audit Message

Other Audit

V 2.0 EVID 15054 Sending SNMP Set

Sub Rule

SNMPD Debug Message

Information

V 2.0 EVID 15055 SNMP CoA Failed

Sub Rule

SNMPD Debug Message

Information

V 2.0 EVID 15056 Portal Settings Undefined

Sub Rule

Interface Configuration Error

Error