• Users making configuration changes. The switch logs who made the configuration changes and thedate and time of the change. However, each specific change on the configuration is not logged. Onlythat the configuration was modified is logged with the user ID, date, and time of the change.• Uncontrolled shutdown.Security LogsThe security log contains security events and information. RBAC restricts access to audit and security logsbased on the CLI sessions’ user roles. The types of information in this log consist of the following:• Establishment of secure traffic flows, such as SSH.• Violations on secure flows or certificate issues.• Adding and deleting of users.• User access and configuration changes to the security and crypto parameters (not the key informationbut the crypto configuration)Important Points to RememberWhen you enabled RBAC and extended logging:• Only the system administrator user role can execute this command.• The system administrator and system security administrator user roles can view security events andsystem events.• The system administrator user roles can view audit, security, and system events.• Only the system administrator and security administrator user roles can view security logs.• The network administrator and network operator user roles can view system events.NOTE: If extended logging is disabled, you can only view system events, regardless of RBAC user role.Example of Enabling Audit and Security LogsDell(conf)#logging extendedDisplaying Audit and Security LogsTo display audit logs, use the show logging auditlog command in Exec mode. To view these logs, youmust first enable the logging extended command. Only the RBAC system administrator user role can view theaudit logs. Only the RBAC security administrator and system administrator user role can view the securitylogs. If extended logging is disabled, you can only view system events, regardless of RBAC user role. To viewsecurity logs, use the show logging command.Example of the show logging auditlog CommandFor information about the logging extended command, see Enabling Audit and Security LogsDell#show logging auditlogMay 12 12:20:25: Dell#: %CLI-6-logging extended by admin from vty0 (10.14.1.98)May 12 12:20:42: Dell#: %CLI-6-configure terminal by admin from vty0 (10.14.1.98)May 12 12:20:42: Dell#: %CLI-6-service timestamps log datetime by admin from vty0(10.14.1.98)Switch Management 68
