System Events

System events are generated by the system manager or middleware unrelated to actual network traffic analysis.

These events are kept persistent between reboots and can be reported via syslog too.

In contrast to status notifications these events cannot be removed individually but only the whole log can be cleared. To be aware of such an action, the deletion of the log will be logged afterwards.

The log is limited to 1000 entries, and new entries will automatically remove old entries. If more elements must be available, external reporting can be used.

Syslog reporting

The events can be reported via syslog to specific server. The configuration allows to enable it and set the TCP syslog server to use.

Available events

• adding, editing or deleting a user
• adding, editing or deleting a role
• user changed its password
• failed login attempt
• successful login
• basicauth login (direct REST API access)
• logout
• web session timeout
• change of management interface settings
• firmware activation
• reboot
• shutdown
• packet processing restart/stop
• capture events like startig a capture session