System Setup and Software Installation Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

PDF

System Setup and Software Installation Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

Audit logging

Updated: June 9, 2026

Want to summarize with AI?

Log in

Explains audit logging as a security and compliance feature that monitors selected system activity, creates audit records, and can forward logs to a remote syslog server for centralized review.

Audit logging is a security and compliance feature that

  • operates according to defined audit rules, automatically creating audit logs whenever specified actions or changes occur on the router,

  • integrates with the Linux Audit Daemon to monitor and log relevant security events across the router, and

  • allows forwarding of audit logs to a remote syslog server.

The Linux audit daemon is a user-space component of the Linux auditing system that

  • tracks and logs system calls, file accesses, user actions, and other events as specified by audit rules, and

  • provides administrators with insights to detect suspicious behavior and maintain system integrity.

Audit rules and audit logs

An audit rule is a configuration that

  • specifies which files, directories, or system events should be monitored,

  • determines the conditions for monitoring, and

  • forms the foundation of an audit logging system.

An audit log is a chronological record that

  • is automatically generated when a monitored event, as defined by an audit rule, occurs, and

  • typically includes details such as the event type, timestamp, user or process involved, and affected resources.

Audit rules and audit logs for security monitoring

Administrators define audit rules to track changes to sensitive files, monitor system calls, and observe other critical activities. By customizing audit rules, organizations can align monitoring with their unique security and compliance requirements.

Audit rules establish what to watch, while audit logs capture and document every relevant occurrence, ensuring a complete and actionable history of system activity.

For example, an audit rule that monitors changes to the /etc/passwd file creates an audit log entry each time this file is modified.

Audit logging is not to be confused with system logging. While audit logging records security-relevant events, such as user actions and changes to sensitive files, system logging (syslog) captures general system events like service status updates, routine errors, or informational messages.

How audit logging works

Audit logging relies on configured rule groups and optional syslog forwarding to monitor security-relevant activity on each node.

Summary

These are the key components involved in this feature:

  • Network administrator: The user who initiates configurations from the CLI.

  • Linux audit daemon: The process that monitors system activity according to the installed rules and writes audit event logs.

  • Local rsyslog daemon: The process that forwards logs to a remote syslog server.

  • Remote syslog server: The external server that maintains the logs generated by the router.

The Linux audit daemon is the core service that performs event monitoring and logging, based on the audit rules configured by the administrator. It operates at the operating system level on each node, such as line cards and processors.

Workflow

These stages describe how audit monitoring and logging works.

  1. The network administrator enables audit monitoring from the CLI.
  2. The router software receives the configuration, applies the relevant audit rules, and distributes these rules to all appropriate nodes.
  3. On each node, the Linux audit daemon monitors system events as defined by the audit rules and writes the logs to the local log file at /var/log/audit/audit.log.
  4. If the network administrator has enabled log forwarding, the audit logs are sent to the local rsyslog daemon, which then forwards the logs to a remote syslog server.

Result

Audit monitoring records security-relevant activity locally and can send the records to a remote syslog server for centralized analysis.

Guidelines for audit logging

Granularity of audit rules

  • Enable or disable audit rules only at the group level, not individually within a group.

  • Regularly review the status of audit rules and audit log forwarding to ensure that monitoring remains effective.

Resource usage on NCS 1014

Use caution when enabling all rule groups, especially rule groups that monitor frequent events, because this configuration may increase CPU, memory, or disk usage. Enable only the groups required for compliance or security needs.

Security of audit logs and syslog servers

  • Allow only users with appropriate administrative privileges to configure or view Linux security audit settings.

  • Protect access to audit logs and syslog servers to prevent unauthorized access or tampering.

Log forwarding to remote syslog servers

  • Confirm that the remote syslog server is reachable and properly configured before enabling log forwarding.

  • Use only trusted network segments for remote syslog servers because NCS 1014 forwards audit logs to remote syslog servers in unencrypted plain text.

These guidelines apply when you enable audit monitoring or audit log forwarding on Cisco NCS 1014.

Notes about audit log storage

Local audit log storage

  • NCS 1014 stores audit logs locally at /var/log/audit/audit.log, unless you enable log forwarding.

  • By default, the system rotates up to five audit log files, each up to 8 MB in size.

These notes apply to local audit log storage when remote forwarding is not enabled.