This section describes how audit logging works on Cisco NCS 1010, including key stages, system behavior, and outcomes that support setup or management workflows.
Summary
These are the key components involved in this feature:
-
Network Administrator: The user who initiates configurations via CLI.
-
Linux audit daemon : The process that monitors system activity according to the installed rules and writes audit event logs.
-
Local rsyslog daemon: The process that forwards logs to a remote syslog server.
-
Remote syslog server: The external server that maintains the logs generated by the router.
The Linux audit daemon is the core service that actually performs event monitoring and logging, based on the audit rules configured by the administrator. It operates at the operating system level on each node, such as line cards and processors.
Workflow
These stages describe how audit monitoring and logging works.
- The network administrator enables audit monitoring via CLI.
- The router software receives the configurations, applies the relevant audit rules, and ensures these rules are distributed to all appropriate nodes.
- On each node, the Linux audit daemon actively monitors system events as defined by the audit rules and writes the logs to a local log file at /var/log/audit/audit.log.
- If the network administrator has enabled log forwarding, the audit logs are sent to the local rsyslog daemon, which then forwards the logs to a remote syslog server.