Connectrix: Brocade B-Series: How to configure the remote syslog for different categories in FOS environments

Answer:
1. Verify the host syslog prior to configuring the audit log. This can be done by reviewing the Fabric OS.
Administrator’s Guide in the section for the Audit Log Configuration. https://docs.broadcom.com/doc/FOS-82x-AG (external link)

2. Connect to the switch to generate an audit log and log in using an account assigned to the admin role.

3. Enter the auditCfg --class command, which defines the specific event classes to be filtered.

switch:admin> auditcfg --class 2,4

Audit filter is configured.

4. Enter the auditCfg --enable command, which enables audit event logging based on the classes configured in step 2.

switch:admin> auditcfg --enable

Audit filter is enabled.
To disable an audit event configuration, enter the auditCfg --disable command.

5. Enter the auditCfg --show command to view the filter configuration. Confirm that the correct event classes are being audited, and that the correct filter state appears. It should be enabled or disabled.

switch:admin> auditcfg --show

Audit filter is enabled.
2-SECURITY
4-FIRMWARE

6. Verify the audit event log setup. To do this, make a change affecting an enabled event class. Confirm that the remote host machine receives the audit event messages.