External Device Interfaces
Introduction
USER_DEVICE events show changes on external interfaces of the ADS‑TEC IRF1000 and IRF3000. They record USB device add/remove, Ethernet link UP/DOWN, and VPN‑Key/CUT input transitions. Use these entries to detect unauthorized USB usage, suspicious link flapping, or unexpected VPN‑Key/CUT state changes.
If a cabinet should be sealed, any USB add operation or IO state change to UP outside a defined maintenance window is a likely policy violation. Configure SIEM rules for repetitive link toggles and for USB activity on production systems.
Note: the IRF1000 has no external USB ports. Therefore IRF1000 devices do not generate USB USER_DEVICE events.
Webinterface View
The VIEW web interface lists USER_DEVICE entries in the Device audit table. The table shows one line per event, ordered by time. The screenshot in this section shows typical IO VPN‑Key/CUT UP/DOWN events, LINK ETH1 DOWN/UP events, and USB add/remove events.
For category USB, the vendor ID and product ID are not displayed in the web interface at the current time. The Interface column is empty for USB events.
Columns in the Device audit table
| Field | Description | Example |
|---|---|---|
| Date | Local device date of the event | 10/16/25 |
| Time | Local device time in HH:MM:SS | 06:01:05 |
| Category | Event category. Possible values: USB, LINK, IO |
LINK |
| Interface | Affected interface. LINK: ETHx. IO: IO_VPNKEY or IO_CUT. USB: empty in the VIEW UI |
ETH1 |
| Operation | State change of the interface. LINK/IO: UP or DOWN. USB: add or remove |
UP |
The VIEW web interface only reformats the audit.log data and labels the columns. It does not add extra interpretation. All detailed information, including mapping to physical interfaces, comes from the audit.log fields described below.
Explanation of the raw audit.log entry
The raw audit.log contains type=USER_DEVICE records written via audit_log_user_message(). Only USER_DEVICE specific fields are described here. Standard auditd fields are filled by auditd itself; for details refer to the official auditd documentation.
USER_DEVICE fields in audit.log
| Field | Description | Example |
|---|---|---|
| type | Audit event type | USER_DEVICE |
| audit(…) | Audit timestamp and sequence in the form audit(epoch.sec:seq) |
1760587…:119 |
| pid | PID of the process that wrote the event | 7496 |
| uid | Effective UID of the process | 0 |
| auid | Audit login UID | 4294967295 |
| ses | Audit session ID | 4294967295 |
| msg.category | Category of the interface event | LINK / USB / IO |
| msg.operation | Operation or state change | UP / DOWN / add / remove |
| msg.interface | Interface identifier. LINK: ETHx. IO: IO_VPNKEY or IO_CUT. Not present for USB |
ETH1 |
| msg.vendor | USB vendor ID (only for category USB) | 23a9 |
| msg.product | USB product ID (only for category USB) | ef18 |
| msg.exe | Executable that logged the event (audit-hw-log, audit-log-netlink, or ubus-gpiocutalarmd) |
/usr/bin/audit-… |
| msg.hostname | Not filled on this platform | ? |
| msg.addr | Not filled on this platform | ? |
| msg.terminal | Not filled on this platform | ? |
| msg.res | Result string. Set to success by default because no context dependent check is done |
success |
| UID | Text form of uid |
root |
| AUID | Text form of auid |
unset |
For SOC or SIEM integration parse the key/value pairs inside msg='…'. Treat a missing interface field for USB events as expected behaviour. A common normalisation is to combine category, operation, and interface into standard fields, for example device.interface=ETH1 and action=link_up for a LINK/UP event.
When the event is generated
The device generates a USER_DEVICE event when a monitored external interface changes state. The same behaviour applies to IRF1000 and IRF3000, except that IRF1000 has no USB USER_DEVICE events.
Categories:
- USB: a USB device with vendor and product IDs is added or removed on the accessible USB port.
- LINK: an Ethernet port link goes UP or DOWN. This usually happens when a cable is plugged in or unplugged, but current firmware also logs software link changes from configuration.
- IO: the VPN‑Key or CUT input signal goes UP or DOWN. During device boot a transition can be logged even if no external change occurred.
Built‑in rate limits:
- LINK: at most 20 messages per day. This protects the audit log from excessive link flapping.
- IO (VPN‑Key/CUT): at most 20 messages per hour.
- USB: no rate limit at this time. Very frequent USB plug/unplug therefore appears fully in the audit log.
Event producers on the device:
- USB events are generated by
audit-hw-log, which is triggered by a kernel uevent via a hotplug shell script. - LINK events are generated by
audit-log-netlink, which listens to link changes via a netlink socket. - IO events are generated by
ubus-gpiocutalarmd, which uses the Linux epoll subsystem to monitor GPIO inputs.
These user space programs write USER_DEVICE messages through the libaudit function audit_log_user_message().
Sample audit.log entry
(1) type=USER_DEVICE msg=audit(1760508902.053:8): pid=5480 uid=0 auid=4294967295 ses=4294967295 msg='category="IO" operation="UP" interface="IO_VPNKEY" exe="/usr/sbin/ubus-gpiocutalarmd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(2) type=USER_DEVICE msg=audit(1760508905.215:9): pid=5480 uid=0 auid=4294967295 ses=4294967295 msg='category="IO" operation="UP" interface="IO_CUT" exe="/usr/sbin/ubus-gpiocutalarmd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(3) type=USER_DEVICE msg=audit(1760508907.624:8): pid=5480 uid=0 auid=4294967295 ses=4294967295 msg='category="IO" operation="DOWN" interface="IO_VPNKEY" exe="/usr/sbin/ubus-gpiocutalarmd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(4) type=USER_DEVICE msg=audit(1760508907.624:9): pid=5480 uid=0 auid=4294967295 ses=4294967295 msg='category="IO" operation="DOWN" interface="IO_CUT" exe="/usr/sbin/ubus-gpiocutalarmd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(5) type=USER_DEVICE msg=audit(1760587265.684:118): pid=7496 uid=0 auid=4294967295 ses=4294967295 msg='category="LINK" operation="DOWN" interface="ETH1" exe="/usr/bin/audit-log-netlink" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(6) type=USER_DEVICE msg=audit(1760587268.032:119): pid=7496 uid=0 auid=4294967295 ses=4294967295 msg='category="LINK" operation="UP" interface="ETH1" exe="/usr/bin/audit-log-netlink" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(7) type=USER_DEVICE msg=audit(1760587484.444:120): pid=13569 uid=0 auid=4294967295 ses=4294967295 msg='category="USB" operation="add" vendor="23a9" product="ef18" exe="/usr/sbin/audit-hw-log" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
(8) type=USER_DEVICE msg=audit(1760587485.148:121): pid=13643 uid=0 auid=4294967295 ses=4294967295 msg='category="USB" operation="remove" vendor="23a9" product="ef18" exe="/usr/sbin/audit-hw-log" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"