SSH Events
The following are the events related to SSH.
Event ID: 433
| Message | Ssh server enabled |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH server is enabled. |
Event ID: 434
| Message | Ssh server disabled |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH server is disabled. |
Event ID: 636
| Message | sftp session from <CLIENT_IP_ADDRESS> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that there was a successful SFTP session. |
Event ID: 637
| Message | scp session from <CLIENT_IP_ADDRESS> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that was a successful SCP session. |
Event ID: 638
| Message | Not enough space available to complete the file transfer |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs there is an error to complete file transfer through SFTP since not enough space is available on the device. |
Event ID: 639 (Severity: Warning)
| Message | scp_error :User <USERNAME> is logged in from <CLIENT_IP_ADDRESS> and cannot access <FILENAME> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that there is SCP error since the user can not access with the given privilege. |
Event ID: 640 (Severity: Warning)
| Message | User <USERNAME>: SFTP error: Invalid Auth Privilege Level to transfer from <CLIENT_IP_ADDR> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that there is SFTP failure for a user to transfer file from a SFTP server. |
Event ID: 641 (Severity: Warning)
| Message | sftp read error- session aborted |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that the SSH session aborted. |
Event ID: 642
| Message | Ssh server enabled in IPv4 mode |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH with IPv4 is enabled. |
Event ID: 643
| Message | Ssh server enabled in IPv6 mode |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH with IPv6 is enabled. |
Event ID: 644
| Message | Ssh server disabled for IPv4 |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH with IPv4 is disabled. |
Event ID: 645
| Message | Ssh server disabled for IPv6 |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH with IPv6 is disabled. |
Event ID: 646
| Message | New RSA-bit 2048 SSH host key installed. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH hostkey is installed. |
Event ID: 647
| Message | SSH host key zeroized. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the SSH host key is zeroized. |
Event ID: 2666
| Message | 2048-bit RSA client public key installed/removed operator/manager access. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that the client public key for SSH is installed. |
Event ID: 2667
| Message | User <USERNAME>: SCP session ended from <CLIENT_IP_ADDRESS> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs a SCP session has ended for a user. |
Event ID: 2668
| Message | SCP_err:The Client '<CLIENT_IP_ADDRESS>' terminated its SCP connection for the User <USERNAME>. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that there is a SCP error. |
Event ID: 2669
| Message | <IP_ADDRESS> |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
Event ID: 3340
| Message | User <USERNAME>: SSH client connection to <SERVER_IP_ADDRESS> started. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs that a SSH client connection has started. |
Event ID: 3341
| Message | User <USERNAME>:SSH client connection to <SERVER_IP_ADDRESS> stopped. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs a SSH client connection has stopped. |
Event ID: 3342 (Severity: Warning)
| Message | User <USERNAME>: SSH client connection to <SERVER_IP_ADDRESS> failed. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that the SSH client connection has failed for a user. |
Event ID: 3343 (Severity: Warning)
| Message | User <USERNAME>: SSH session aborted due to public-key authentication failure |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that the SSH session is aborted for a user due to the public-key authentication failure. |
Event ID: 3344
| Message | User <USERNAME>: SSH session established with public-key authentication |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
| Description | This log event informs a SSH session established for a user with public-key authentication. |
Event ID: 3345
| Message | User <USERNAME>: Login failed for <SSH> session from <IP_ADDRESS>. |
| Platforms | K, KA, KB, RA, WB, WC, YA, YB, YC |
| Category | SSH |
| Severity | Information |
Event ID: 3398 (Severity: Warning)
| Message | The two-factor authentication for SSH session failed due to <LOG_MESSAGE> |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that the two-factor authentication for SSH session failed due to username/password authentication. |
Event ID: 3399 (Severity: Warning)
| Message | <USERNAME/PASSWORD> will not be considered for the two-factor authentication for SSH session. |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Warning |
| Description | This log event informs that the two-factor authentication for SSH session will not be considered if 1) The client public keys installed without user name. 2) There is conflict in the privilege levels for the user associated with SSH key to the user associated with the privilege. |
Event ID: 5552
| Message | Rekey is initiated <ENABLE/DISABLE>. |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Information |
| Description | Logged when switch acting as SSH client, initiates a rekey request: I 05/22/13 20:39:20 05514 ssh: Rekey is initiated from SSH client by user ‘abc’. Logged when switch acting as SSH server, initiates a rekey request: I 05/22/13 20:39:20 05352 ssh: Rekey is initiated from SSH server for session-2. Logged when switch acting as SSH client, receives a rekey request. I 05/22/13 20:39:20 05514 ssh: Rekey is initiated from SSH server for user ‘abc’. Logged when switch acting as SSH server, receives a rekey request. I 05/22/13 20:39:20 05514 ssh: Rekey is initiated from SSH client for session-2. |
Event ID: 5553
| Message | User:'<USER_NAME>': Session rekey <ENABLE/DISABLE>. |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Information |
| Description | Rekey is enabled: I 05/22/13 20:39:20 05353 ssh: User:'user1': Session rekey is enabled. Rekey is disabled: I 05/22/13 20:39:20 05353 ssh: User:'user1': Session rekey is disabled. |
Event ID: 5554
| Message | <General informational string messages> |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Information |
| Description | General informational string messages: |
Event ID: 5555
| Message | User:'<USER>': Session rekey will be initiated after <TIME/VOLUME> <SESSION/DATA>. |
| Platforms | KB, WB, WC, YC |
| Category | SSH |
| Severity | Information |
| Description | Logged when user configures the time/volume for rekey initiation. |