Important Points to RememberWhen you enabled RBAC and extended logging:• Only the system administrator user role can execute this command.• The system administrator and system security administrator user roles can view security events andsystem events.• The system administrator user roles can view audit, security, and system events.• Only the system administrator and security administrator user roles can view security logs.• The network administrator and network operator user roles can view system events.NOTE: If extended logging is disabled, you can only view system events, regardless of RBAC userrole.Example of Enabling Audit and Security LogsDell(conf)#logging extendedDisplaying Audit and Security LogsTo display audit logs, use the show logging auditlog command in Exec mode. To view these logs,you must first enable the logging extended command. Only the RBAC system administrator user role canview the audit logs. Only the RBAC security administrator and system administrator user role can view thesecurity logs. If extended logging is disabled, you can only view system events, regardless of RBAC userrole. To view security logs, use the show logging command.Example of the show logging auditlog CommandFor information about the logging extended command, see Enabling Audit and Security LogsDell#show logging auditlogMay 12 12:20:25: Dell#: %CLI-6-logging extended by admin from vty0 (10.14.1.98)May 12 12:20:42: Dell#: %CLI-6-configure terminal by admin from vty0(10.14.1.98)May 12 12:20:42: Dell#: %CLI-6-service timestamps log datetime by admin fromvty0 (10.14.1.98)Example of the show logging Command for SecurityFor information about the logging extended command, see Enabling Audit and Security LogsDell#show loggingJun 10 04:23:40: %STKUNIT0-M:CP %SEC-5-LOGIN_SUCCESS: Login successful for useradmin on line vty0 ( 10.14.1.91 )Clearing Audit LogsTo clear audit logs, use the clear logging auditlog command in Exec mode. When RBAC isenabled, only the system administrator user role can issue this command.Example of the clear logging auditlog CommandDell# clear logging auditlogConfiguring Logging FormatTo display syslog messages in a RFC 3164 or RFC 5424 format, use the logging version {0 | 1}command in CONFIGURATION mode. By default, the system log version is set to 0.62 Management
