Analyzing Audit log entries
The format of a File System Audit log entry is:
CGP2602I: [SecFS, 0] Level: Policy[policyName?] User[userID?] Process[command?] Access[whatIsItDoing?] Res[whatIsItDoingItTo?] Effect[allowOrDeny? Code (whatMatched?)]
| Parameter | Description |
|---|---|
| Identifier | The TLA for the error message. |
| SECFS | Indicates that the message was generated by an Agent. You can enter secfs in the Search Message field in the Logs window to display the Agent policy evaluation and GuardPoint activity for all configured hosts. |
| Level | Indicates the importance of the message. For example, AUDIT indicates an informational message, whereas ALARM indicates a critical failure that you should not ignore. |
| Policy | Indicates the name of the policy that is being used to evaluate the access attempt. |
| User | Identifies the system user attempting to access data in the GuardPoint. It typically displays the user name, user ID, and group ID. |
| Process | Indicates the command, script, or utility being executed. |
| Access | Indicates what access is being attempted. Access may be read_dir, remove_file, write_file_attr, write_app, create_file, etc. These correspond to the Access methods that you configure in the policy. Read_dir corresponds to d_rd. Remove_file corresponds to f_rm, etc. |
| Res | Indicates the object/resource being accessed by the Process[]. |
| Effect | Indicates the rule that matched and, based upon that rule, whether or not theCipherTrust Manager grants access. Access states may be either PERMIT or DENIED. |
