User-Based Tunnels Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

User-Based Tunnels Events

Base Rule

User Information

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 9701, 9702, 9703, 9704, 9705, 9706, 9707, 9708, 9709, 9710, 9711, 9712, 9713, 9714, 9715, 9716, 9717, 9718, 9719, 9720, 9721, 9722, 9723, 9724, 9725, 9726, 9727, 9728, 9729, 9730, 9731, 9732

Severity

<severity>

Text/String

For 9723-9732: Information
For 9702, 9703, 9705, 9708, 9710,9712, 9714, 9716,9718, 9720, 9722, 9724, 9726, 9728, 9730, 9732: Error
For 9706 : Critical

Message

<subject>
<sip>
<status>

Text/String/IP Address

Event ID 9701:
Event raised when controller is selected as Active/Standby

<subject>
<sip>

Text/String/IP Address

Event ID 9702:
Event raised when heartbeat not received from a SAC

<subject>
<dip>

Text/String/IP Address

Event ID 9703:
Event raised when keepalive not received from a UAC

<subject>
<sip>

Text/String/IP Address

Event ID 9704:
Event raised when SAC bootstapping to a SAC is re-initialized

<subject>

Text/String

Event ID 9705:
Event raised when papi msg key sent and received is different ({key_id})

<subject>
<dip>

Text/String/IP Address

Event ID 9706:
Event raised when UAC node is down

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9707:
Event raised when user based tunnel is created

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9708:
Event raised when user based tunnel creation fails

<subject>

Text/String

Event ID 9709:
Event raised when user based tunnel is deleted

<subject>

Text/String

Event ID 9710:
Event raised when user based tunnel deletion fails

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9711:
Event raised when user based tunnel state is up

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9712:
Event raised when user based tunnel state is down

<subject>
<dmac>

Text/String

Event ID 9713:
Event raised when user is gets binded to tunnel

<subject>
<dmac>

Text/String

Event ID 9714:
Event raised when user bind to tunnel id failed

<subject>
<dmac>

Text/String

Event ID 9715:
Event raised when user is gets binded to tunnel

<subject>
<dmac>

Text/String

Event ID 9716:
Event raised when user unbind to tunnel id failed

<subject>
<dmac>

Text/String

Event ID 9717:
Event raised when already binded user to a tunnel gets modified

<subject>
<dmac>

Text/String

Event ID 9718:
Event raised when modification of already binded user to a tunnel fails

<subject>
<dport>
<dmact>

Text/String/Number

Event ID 9719:
Event raised on NFD port creation

<subject>
<dport>
<dmact>

Text/String/Number

Event ID 9720:
Event raised on NFD port creation failure

<subject>

Text/String

Event ID 9721:
Event raised on NFD port deletion

<subject>

Text/String

Event ID 9722:
Event raised when NFD port deletion fails

<subject>

Text/String

Event ID 9723:
Event raised on ECMP group creation

<subject>

Text/String

Event ID 9724:
Event raised on ECMP group creation failure

<subject>

Text/String

Event ID 9725:
Event raised on ECMP group deletion

<subject>

Text/String

Event ID 9726:
Event raised when ECMP group deletion fails

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9727:
Event raised when mdest rx user based tunnel is created

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9728:
Event raised when mdest rx user based tunnel creation fails

<subject>

Text/String

Event ID 9729:
Event raised when mdest rx user based tunnel is deleted

<subject>

Text/String

Event ID 9730:
Event raised when mdest rx user based tunnel deletion fails

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9731:
Event raised when mdest rx user based tunnel state is up

<subject>
<sip>
<dip>

Text/String/IP Address

Event ID 9732:
Event raised when mdest rx user based tunnel state is down