For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chris_FP's avatar
Chris_FP
Icon for Cirrus rankCirrus
Aug 04, 2014

Explanation of codes within Syslog messages

From below:-

 

<133>Jul 29 10:17:21 nodename httpd[5382]: 01070417:5: AUDIT - userhere user - RAW: httpd(mod_auth_pam): user=userhere(userhere) partition=[All] level=Administrator tty=/bin/bash host=x.x.x.x attempts=1 start="Tue Jul 29 10:17:21 2014".

 

<85>Jul 29 10:17:21 nodename httpd[5382]: 01070417:5: AUDIT - user userhere - RAW: httpd(mod_auth_pam): user=userhere(userhere) partition=[All] level=Administrator tty=/bin/bash host=x.x.x.x attempts=1 start="Tue Jul 29 10:17:21 2014".

 

<133>Jul 29 10:17:05 nodename httpd[4782]: 01070417:5: AUDIT - user userhere - RAW: httpd(mod_auth_pam): user=userhere(userhere) partition=[All] level=Administrator tty=/bin/bash host=x.x.x.x attempts=1 start="Tue Jul 29 10:04:48 2014" end="Tue Jul 29 10:17:05 2014".

 

<85>Jul 29 10:17:05 nodename httpd[4782]: 01070417:5: AUDIT - user userhere - RAW: httpd(mod_auth_pam): user=userhere(userhere) partition=[All] level=Administrator tty=/bin/bash host=x.x.x.x attempts=1 start="Tue Jul 29 10:04:48 2014" end="Tue Jul 29 10:17:05 2014".

 

<133>Jul 29 10:41:35 nodename mcpd[6180]: 01070417:5: AUDIT - user userhere - transaction 50874725-2 - object 0 - modify { ltcfg_instance { ltcfg_instance_container "" ltcfg_instance_name "/Common/syslog" ltcfg_instance_class_name "syslog" ltcfg_instance_instance_folder_name "/Common" ltcfg_instance_instance_leaf_name "syslog" ltcfg_instance_config_source 0 } } [Status=Command OK]

 

<133>Jul 29 10:41:35 nodename mcpd[6180]: 01070417:5: AUDIT - user userhere - transaction 50874725-3 - object 0 - create_if { ltcfg_instance_field { ltcfg_instance_field_instance_name "/Common/syslog" ltcfg_instance_field_field_name "include" ltcfg_instance_field_class_name "syslog" ltcfg_instance_field_container "" ltcfg_instance_field_value "destination remote_server {tcp(\"siem1pre.service.test.group\" port (514));};filter f_alllogs {level (notice..emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};destination remote_server2 {tcp(\"10.127.222.10\" port (514));};log {source(local);filter(f_alllogs);destination(remote_server2);};" ltcfg_instance_field_userspec 1 ltcfg_instance_field_config_source 0 } } [Status=Command OK]

 

<133>Jul 29 10:41:35 nodename mcpd[6180]: 01070417:5: AUDIT - user userhere - transaction 50874725-3 - object 0 - create_if { ltcfg_instance_field { ltcfg_instance_field_instance_name "/Common/syslog" ltcfg_instance_field_field_name "include" ltcfg_instance_field_class_name "syslog" ltcfg_instance_field_container "" ltcfg_instance_field_value "destination remote_server {tcp(\"siem1pre.service.test.group\" port (514));};filter f_alllogs {level (notice..emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};destination remote_server2 {tcp(\"10.127.222.10\" port (514));};log {source(local);filter(f_alllogs);destination(remote_server2);};" ltcfg_instance_field_userspec 1 ltcfg_instance_field_config_source 0 } } [Status=Command OK]

 

At the start of each msg is a number, either 133 or 85 - Does anybody know what the significance / meaning of these numbers is and if there is a list defined anywhere

 

In addition I have bolded numbers in brackets - Is there an explanation of these numbers anywhere?

 

If we can get an explanation for these numbers it will help our Qradar team to script filters for creating incidents based on logon/logoff/config events etc.

 

Regards.

 

syslog

1 Reply

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Aug 04, 2014

    At the start of each msg is a number, either 133 or 85 - Does anybody know what the significance / meaning of these numbers is and if there is a list defined anywhere

    i understand it is priority number.

      (numeric value of facility) * 8 + (numeric value of severity)

    Pot Of Syslog-NG Tricks Version 3

    http://www.syslog.org/logged/pot-of-syslog-ng-tricks-version-3/

    In addition I have bolded numbers in brackets - Is there an explanation of these numbers anywhere?

    it is process id.

    [root@ve11a:Active:In Sync] config  tail -1 /var/log/ltm
Aug  4 04:36:15 ve11a info sshd[6970]: Accepted keyboard-interactive/pam for root from 192.168.207.46 port 50504 ssh2

[root@ve11a:Active:In Sync] config  ps -elf|grep sshd:|grep -v grep
4 S root      6970  5379  0  80   0 -  5439 -      04:36 ?          0:00 sshd: root@pts/0