Overview

The security audit log allows administrators to monitor security-related events on a device, including failed user authorization, successful administrator authentication, and Kerberos file uploads to a device By default, security logs are stored on the device, but can also be transmitted to a network system log (syslog) server for processing or storage. Note: Security Audit Log settings are available for selected printer models only. Xerox recommends that you enable audit in secure environments. From the Embedded Web Server, click Settings > Security > Security Audit Log. To activate security audit logging, select Enable Audit. The transmission to a network syslog server option lets you use both the remote syslog server and the internal logging. Configure transmission to a network syslog server. Select Enable Remote Syslog. Configure the Remote Syslog settings. Remote Syslog Server: Type the IP address or host name of the server. Remote Syslog Port: Type the port number used for the destination server The default number is 514. Remote Syslog Method: To send log messages and events using a lower-priority transmission protocol, select Normal UDP Otherwise, select Stunnel . Remote Syslog Facility: Select a facility code for events logged to the destination server All events sent from the device are tagged with the same code, which aids in sorting and filtering by network monitor or intrusion detection software. Severity of Events to Log: Select the priority level cutoff for logging messages and events The highest severity is 0 The lowest severity is 7 Events with the selected severity level and higher are logged For example, if you select 4 - Warning, then severity levels 0-4 are logged. Remote Syslog Non-Logged Events: Send all events to the remote server, regardless of severity. Select Enable Remote Syslog. Configure the Remote Syslog settings. Remote Syslog Server: Type the IP address or host name of the server. Remote Syslog Port: Type the port number used for the destination server The default number is 514. Remote Syslog Method: To send log messages and events using a lower-priority transmission protocol, select Normal UDP Otherwise, select Stunnel . Remote Syslog Facility: Select a facility code for events logged to the destination server All events sent from the device are tagged with the same code, which aids in sorting and filtering by network monitor or intrusion detection software. Severity of Events to Log: Select the priority level cutoff for logging messages and events The highest severity is 0 The lowest severity is 7 Events with the selected severity level and higher are logged For example, if you select 4 - Warning, then severity levels 0-4 are logged. Remote Syslog Non-Logged Events: Send all events to the remote server, regardless of severity. Remote Syslog Server: Type the IP address or host name of the server. Remote Syslog Port: Type the port number used for the destination server The default number is 514. Remote Syslog Method: To send log messages and events using a lower-priority transmission protocol, select Normal UDP Otherwise, select Stunnel . Remote Syslog Facility: Select a facility code for events logged to the destination server All events sent from the device are tagged with the same code, which aids in sorting and filtering by network monitor or intrusion detection software. Severity of Events to Log: Select the priority level cutoff for logging messages and events The highest severity is 0 The lowest severity is 7 Events with the selected severity level and higher are logged For example, if you select 4 - Warning, then severity levels 0-4 are logged. Remote Syslog Non-Logged Events: Send all events to the remote server, regardless of severity. Configure the email notification settings. To ensure the that the printer settings have been configured for email, in the Admin's Email Address field, type one or more email addresses separated by commas. Email Log Cleared Alert: Send a notification when the user clicks the Delete Log button. Email Log Wrapped Alert: Send a notification when the log becomes full and begins to overwrite the oldest entries. Log Full Behavior: Wrap over oldest entries or email the log and then delete all entries. Email % Full Alert: Send a notification when log storage space reaches a certain percentage of capacity. % Full Alert Level: Specify how full the log is before an alert is triggered. Email Log Exported Alert: Send a notification when the log file is exported. Email Log Settings Changed Alert: Send a notification when the log settings are changed. Log Line Endings: Specify how the log file terminates the end of each line. Digitally Sign Exports: Add a digital signature to each exported log file. Email Log Cleared Alert: Send a notification when the user clicks the Delete Log button. Email Log Wrapped Alert: Send a notification when the log becomes full and begins to overwrite the oldest entries. Log Full Behavior: Wrap over oldest entries or email the log and then delete all entries. Email % Full Alert: Send a notification when log storage space reaches a certain percentage of capacity. % Full Alert Level: Specify how full the log is before an alert is triggered. Email Log Exported Alert: Send a notification when the log file is exported. Email Log Settings Changed Alert: Send a notification when the log settings are changed. Log Line Endings: Specify how the log file terminates the end of each line. Digitally Sign Exports: Add a digital signature to each exported log file. 5 Click Save.