show log audit

Description

Use the show log audit command to view audit log contents.

This log lists all configuration changes (create, modify, delete) and all system actions such as login/logout made by any users (CLI, Appliance Manager, or GMS). Each log entry contains a timestamp, the appliance hostname, the username and IP address of the user, the action or change applied, and whether the operation succeeded or failed.

Syntax

show log audit

show log audit continuous

show log audit files [<file number>]

show log audit files <file number> [matching <regular expression>]

show log audit matching <regular expression>

Arguments

continuous	Displays new log messages as they arrive.
files	Displays a listing of all available archived log files.
files <file number>	Specifies which archived log file number to display.
matching <regular expression>	Displays event logs that match a given regular expression. If the expression includes spaces, use quotation marks to enclose the expression.

Defaults

None.

Command Mode

Privileged EXEC Mode

Global Configuration Mode

See Also

None.

Usage Guidelines

To see what archived logs are available, use one of the following:

(config) # show log audit files ?

Examples

n	To view new alert log messages as they arrive:

Tallinn (config) # show log audit continuous

 

n	To view the #6 archived audit log file:

(config) # show log audit files 6

Please send comments or suggestions regarding user documentation to techpubs@silver-peak.com.