System Setup and Software Installation Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

PDF

System Setup and Software Installation Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

Configure audit logging

Updated: September 10, 2026

Want to summarize with AI?

Log in

Configures audit logging on Cisco NCS 1014 by enabling audit rule groups, verifying their status, and optionally forwarding audit logs to a remote syslog server.

Configure and monitor audit logs for specific system events by enabling the relevant audit rule groups.

Enable audit rule groups to monitor specific files, directories, or system events. Optional syslog forwarding sends audit logs to a configured remote syslog server for centralized analysis.

Procedure

  1. Enter the linux security audit monitor <group-keyword> command to enable a group of audit rules.

    Example:

    RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# linux security audit monitor xr-software
RP/0/RP0/CPU0:ios(config)# linux security audit monitor user-group-config-files
RP/0/RP0/CPU0:ios(config)# commit

  2. Enter the show linux security audit monitor status command to verify the general status of all active audit rule groups.

    Example:

    RP/0/RP0/CPU0:ios# show linux security audit monitor status
Wed Aug 20 16:16:23.518 IST
key name: xr-software                  status: enabled             
rules:
-a always,exit -F arch=b64 -F dir=/pkg/bin -F perm=wa -k xr_bin_changes
-a always,exit -F arch=b64 -F dir=/pkg/sbin -F perm=wa -k xr_sbin_changes
-a always,exit -F arch=b64 -F dir=/pkg/lib -F perm=wa -k xr_lib_changes
--------------------------------------------------------------
key name: user-group-config-files      status: enabled             
rules:
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -k passwd_changes
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -k shadow_changes
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -k group_changes
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -k sudoers_changes
--------------------------------------------------------------

  3. Optional: Enter the linux security audit logging syslog command to enable forwarding of audit logs.

    Example:

    RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# linux security audit logging syslog
RP/0/RP0/CPU0:ios(config)# commit

  4. Optional: Enter the logging remote-server-ip vrf vrf-name command to configure the remote syslog server.

    Example:

    RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# logging 10.0.1.2 vrf default severity info port default facility local6
RP/0/RP0/CPU0:ios(config)# commit

  5. Optional: Enter the show linux security audit logging syslog command to verify whether audit log forwarding is enabled and to view the configured remote syslog server.

    Example:

    RP/0/RP0/CPU0:ios# show linux security audit logging syslog
Wed Aug 20 16:16:44.553 IST
status: enabled             
syslog-server(s):
ipaddr: 10.0.1.2 vrf: vrf-default port: 514
ipaddr: 10.0.1.9 vrf: vrf-default port: 514

Audit logging monitors the enabled rule groups and forwards audit logs when syslog forwarding and remote server configuration are enabled.