Cisco Firepower 4110 Preparative Procedures & Operational User Manual page 23

Cisco Preparative Procedures & Operational User Guide
SFR Auditable
Event
FTP_TRP.1 Initiation of
the trusted
channel.
Termination
of the trusted
channel.
Failures of
the trusted
path
functions.
© 2016 Cisco Systems, Inc. All rights reserved.
Actual Audited Event
IP_ADDRESS:443) - httpd[8926]
%USER-6-SYSTEM_MSG: [ssl:info] [pid 8926:tid 1823603600] [client
IP_ADDRESS:60782] AH01998: Connection closed to child 124 with abortive
shutdown (server IP_ADDRESS:443) - httpd[8926]
%USER-6-SYSTEM_MSG: [ssl:info] [pid 8926:tid 1823603600] SSL Library
Error: error:14076129:SSL routines:SSL23_GET_CLIENT_HELLO:only tls
allowed in fips mode - httpd[8926]
SSH
%FPRM-6-AUDIT: [session][internal][creation][internal][213987][sys/user-
ext/sh-login-admin-pts_0_1_4614][id:pts_0_1_4614, name:USERNAME,
policyOwner:local][] Fabric A: local user USERNAME logged in from
IP_ADDRESS
%AUTHPRIV-6-SYSTEM_MSG: pam_unix(sshd:session): session closed for
user USERNAME – sshd[25700]
%AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user
USERNAME from IP_ADDRESS - sshd[3094]
%DAEMON-6-SYSTEM_MSG: input_userauth_request: invalid user temp -
sshd[31864]
HTTPS
%FPRM-6-AUDIT: [session][internal][creation][internal][211634][sys/user-
ext/web-login-admin-web_60027_A][id:web_60027_A, name: USERNAME,
policyOwner:local][] Web A: local user USERNAME logged in from
IP_ADDRESS
%FPRM-6-AUDIT: [session][internal][deletion][internal][1205449][sys/user-
ext/user- USERNAME / term-web_27244_A][sys/user-ext/user- USERNAME
n/term-web_27244_A][] Fabric A: user USERNAME terminated session id
ttyS0_1_3038
%AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user
USERNAME from IP_ADDRESS - httpd[8515]