Event Log (Platform)

Activity within the Apstra environment is recorded in an event log which you can use for auditing purposes. Events for the following event types are logged):

• User login (success and failure) (Login)

• User logout (Logout)

• User creation, by creating or cloning (UserCreate) (new in Apstra version 4.1.2)

• User Edit (UserUpdate) (new in Apstra version 4.1.2)

• User Delete (UserDelete) (new in Apstra version 4.1.2)

• Blueprint commit (applies changes from staged to active blueprint)

• Blueprint revert (discards changes in staged blueprint)

• Blueprint rollback (rolls back the staged blueprint to a previous version)

• Blueprint deletion

• Device Config change

• Operation Mode changed by user (maintenance, normal, read-only)

• Operation Mode changed by system (new in Apstra version 4.1.2)

  • Normal - when disk usage and memory is under the utilization threshold, the operation mode is in read/write mode

  • Maintenance - when utilization threshold is surpassed, the system moves API layer to read-only mode

• Changes to login banned/allowed list (new in Apstra version 4.1.1)

• Syslog Configuration creation, by creating or cloning (SyslogCreate) (new in Apstra version 4.1.2)

• Syslog Edit (SyslogUpdate) (new in Apstra version 4.1.2)

• Syslog Delete (SyslogDelete) (new in Apstra version 4.1.2)

Each event includes the following information which is searchable and sortable:

• Time - when the event occurred (hover over time field to see date and time)

• User - username of person who performed the activity

• Source IP - The source IP address of the client making the HTTP request

• Type - type of event (listed above)

• Device ID (as applicable) - typically the serial number of the managed device on which the action was taken

• Device Config (as applicable) - The config that is pushed and applied on the device

• Blueprint ID (as applicable) - The ID of the blueprint on which action was taken

• Blueprint name (as applicable) - The blueprint label on which action was taken

• Result - The outcome of the activity. Success means operation is accepted by the system. In the case of an error, the error string is included (unauthorized, for example)

From the left navigation menu, navigate to Platform > Event Log to go to the table of events that have been logged.

You can search recent history for audit events.

• To filter the table, click Query:All and enter your query.
• To view device details (info, pristine config, telemetry), click a device ID.
• To view device configuration, click View Config.

Audit events are written to log-rotated files as a second repository. You can configure logrotate parameters in the Apstra server configuration file (/etc/aos/aos.conf). You can export and ship audit events to syslog.

For details about sending the event log to an external system with the Syslog protocol, see Syslog Configuration.