Skip to main content
Skip table of contents

Radius Authorization Policy Messages

Vendor Documentation

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log FieldLogRhythm DefaultLogRhythm Default v2.0
pri_numN/AN/A
timeN/AN/A
IP address/hostnameN/AN/A
cat_nameN/A<vendorinfo>
msg_idN/AN/A
total_segN/AN/A
seg_numN/AN/A
timestampN/AN/A
sequence_numN/AN/A
msg_code<vmid><vmid>
<tag1>
msg_sev<severity><severity>
msg_classN/A<subject> 
msg_textN/A<action> 
Key1N/AN/A
Key2N/AN/A
ConfigVersionId<version>N/A
Device IP Address<sip>N/A
UserName<sname><login>
Protocol<protname><protname>
RequestReceivedTimeN/AN/A
PolicyType<policy>N/A
OriginalUserName<login>N/A
AcsSessionID<session><session>
SelectedAccessService<process>N/A
SelectedAuthorizationProfiles<action>N/A
IdentityPolicyMatchedRule<subject>N/A
AuthorizationPolicyMatchedRule<result>N/A
CPMSessionIDN/AN/A
ISEPolicySetName<objectname><policy>
IdentitySelectionMatchedRuleN/AN/A
HostIdentityGroup<group><group>
Name<object>N/A
ResponseN/A<result>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex IDRule NameRule TypeCommon EventClassification
1010530Radius Authorization Policy MessagesBase RuleRADIUS Access-Reject ReceivedInformation

LogRhythm Default v2.0

Regex IDRule NameRule TypeCommon EventClassification
1012731V 2.0 Policy Diagnostics EventBase RuleDiagnostic InformationInformation
V 2.0 EVID 15001 Adapter Contain Atleast One ValSub RuleIncorrect Database ConfigurationError
V 2.0 EVID 15002 Configured Operator FailedSub RuleDatabase Configuration Change FailedError
V 2.0 EVID 15003 Incorrect Database ConfigurationSub RuleIncorrect Database ConfigurationError
V 2.0 EVID 15004 Matched RuleSub RuleMatched RuleInformation
V 2.0 EVID 15005 Matched Monitored RuleSub RuleMatched Monitored RuleInformation
V 2.0 EVID 15006 Matched Default RuleSub RuleMatched Default RuleInformation
V 2.0 EVID 15007 Policy Result Type UnmatchedSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15008 Evaluating Svc Selection PolicySub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15009 Authorization Policy Not ConfigSub RulePolicy Not ConfiguredError
V 2.0 EVID 15010 Policy Not ConfiguredSub RulePolicy Not ConfiguredError
V 2.0 EVID 15011 Authorization Policy Not ConfigSub RulePolicy Not ConfiguredError
V 2.0 EVID 15012 Selected Access ServiceSub RuleAccess Service SelectedInformation
V 2.0 EVID 15013 Selected Identity SourceSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15015 Could Not Find ID StoreSub RuleID Store Not FoundError
V 2.0 EVID 15016 Selected Authorization ProfileSub RuleAuthorization Profile SelectedInformation
V 2.0 EVID 15017 Selected Shell ProfileSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15018 Selected Command SetSub RuleCommand Set SelectedInformation
V 2.0 EVID 15019 Authorization Profiles Not FindSub RuleAuthorization Profiles Not FoundError
V 2.0 EVID 15020 Shell Profiles Not FindSub RuleShell Profiles Not FoundError
V 2.0 EVID 15021 Command Set Not FindSub RuleCommand Set Not FoundWarning
V 2.0 EVID 15022 Access Service Not FindSub RuleAccess Service Not FoundError
V 2.0 EVID 15023 Could Not Match RuleSub RuleRule Not MatchedInformation
V 2.0 EVID 15024 PAP Not AllowedSub RulePAP Not AllowedInformation
V 2.0 EVID 15025 Policy Not ConfiguredSub RulePolicy Not ConfiguredError
V 2.0 EVID 15026 External Policy Server Not FoundSub RulePolicy Not ConfiguredError
V 2.0 EVID 15027 External Policy Server SelectedSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15028 Sending Request To Ext. ServerSub RuleSending RequestInformation
V 20 EVID 15029 Attr Not Retrieve Frm Ext PolicySub RuleAttributes Not RetrievedError
V 2.0 EVID 15030 Misconfig Of Ext. Policy ServerSub RuleApparent MisconfigurationError
V 2.0 EVID 15031 Ext Policy Attributes RetrievedSub RuleAttributes RetrievedInformation
V 2.0 EVID 15032 Evaluating External Policy CheckSub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15033 Mapping Policy Not ConfiguredSub RulePolicy Not ConfiguredError
V 2.0 EVID 15034 Skip External Policy CheckSub RulePolicy Check SkippedWarning
V 2.0 EVID :15035 Evaluating Exception Auth PolicySub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15036 Evaluating Authorization PolicySub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15037 Access ServiceSub RuleAccess Service SelectedInformation
V 2.0 EVID 15038 Skipping External PolicySub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15039 Rejected Per Auth. ProfileSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15040 Attribute Not Defined Cert.Sub RuleMissing AttributeWarning
V 2.0 EVID 15041 Evaluating Identity PolicySub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15042 No Rule Was MatchedSub RuleRule Not MatchedInformation
V 2.0 EVID 15043 Attribute Value UnavailableSub RuleMissing AttributeWarning
V 2.0 EVID 15044 Evaluating Group Mapping PolicySub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15045 CHAP Not AllowedSub RuleCHAP Not AllowedWarning
V2.0 EVID 15046 MS-CHAP V1 DisabledSub RuleProtocol DisabledInformation
V2.0 EVID 15047 MS-CHAP V2 DisabledSub RuleProtocol DisabledInformation
V 2.0 EVID 15048 Queried PIPSub RuleQuery InformationInformation
V 2.0 EVID 15049 Evaluating Policy GroupSub RuleEvaluating PolicyOther Audit
V 2.0 EVID 15050 Dev. Not Support Config Of VLANSub RuleCaution Message Concerning Vlan ConfigurationInformation
V 2.0 EVID 15051 Device Not Support Config Of ACLSub RuleUnsupported ACLWarning
V 2.0 EVID 15052 Authorization Profile Not SuitedSub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15053 N/W Access Dev. Not Support CoASub RuleGeneral Audit MessageOther Audit
V 2.0 EVID 15054 Sending SNMP SetSub RuleSNMPD Debug MessageInformation
V 2.0 EVID 15055 SNMP CoA FailedSub RuleSNMPD Debug MessageInformation
V 2.0 EVID 15056 Portal Settings UndefinedSub RuleInterface Configuration ErrorError
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.