Configuration Changes

Introduction

USYS_CONFIG events record every configuration change on ADS-TEC IRF1000/IRF3000 devices. The event payload contains the affected configuration table, the changed key, the new value, and the condition that selected the row. The device logs sensitive or deprecated values as XXX to avoid credential leakage and to indicate cleared legacy fields such as password_md5. Use these events to understand who changed what and when in OT environments. From a security view you should look for unexpected user insert or delete operations, password updates outside approved maintenance windows, bulk edits to the config table, or repeated failed changes. Investigate events where the acting user is unexpected, where changes originate from maintenance-disabled accounts, or where a configuration change is immediately followed by VPN or session creation from a new source address.

Webinterface View

Configuration changes are shown in the VIEW web interface on the Configuration audit page. Each row in the table represents one USYS_CONFIG operation and is displayed in device local time. For these events the Action Taken column always shows the normalized label changed-configuration.

Field	Description	Example
Date	Event date in device local time	10/14/25
Time	Event time with seconds	15:57:21
Username	User that performed the change (mapped from `terminal`)	admin
Action Taken	Normalized action label for configuration writes	changed-configuration
Result	Outcome of the operation	success
Table	Target configuration table	users
Operation	Operation type (`insert`, `update`, `delete`)	update
Key	Column or configuration key that changed	password_md5
Value	New value. Sensitive or legacy values are shown as `XXX`.	XXX
Condition	Selector used to identify the affected row; empty for inserts	name=test

Insert operations show an empty Condition and a Value list that contains the new row values, with sensitive fields masked as XXX.

Updates of password_* keys are masked in Value. In the example, the password_md5 key is a legacy column that is no longer used; it is cleared and therefore appears as XXX.

Explanation of the raw audit.log entry

Each USYS_CONFIG line in audit.log uses the standard Linux audit record format. ADS-TEC specific semantics are contained in the quoted msg payload. Auditd-internal fields such as pid, uid, auid, ses, UID, and AUID follow the normal auditd behaviour; see the official auditd documentation for details. The device does not populate hostname or addr for these events.

Field	Description	Example
type	Audit record type	USYS_CONFIG
msg header	`audit(epoch:serial)` identifier of the record	audit(1760450241.912:100)
pid	Process ID (auditd standard field)	5465
uid	Effective UID (auditd standard field)	0
auid	Login UID (auditd standard field)	4294967295
ses	Audit session ID (auditd standard field)	4294967295
msg payload	Quoted key-value list carrying change details	'table="users" ...'
table	Target table of the configuration change	users
operation	Operation applied to the table (`insert`, `update`, `delete`)	update
key	Column or configuration key whose value is changed	password_argon2
value	New value written to the key. Secrets are logged as `XXX`.	XXX
condition	WHERE-like selector that identifies the affected row; can be empty	name=test
exe	Executable that performs the change	/usr/sbin/systemd
hostname	Not populated for these events	?
addr	Not populated for these events	?
terminal	User name that initiated the change, as seen by the system	admin
res	Result of the operation (`success` or `failure`)	success
UID	Human-readable form of `uid`	root
AUID	Human-readable form of `auid`	unset

SIEM and SOC integration hints:

Alert on operation=insert or operation=delete on table=users, and on key=password_* updates outside approved change windows.
Correlate the terminal field (shown as Username in the web interface) with authentication logs to confirm the real user identity.
Track bursts of updates on table=config to detect bulk or scripted unauthorized changes.
Investigate sequences with res=failure followed by res=success for the same user or table, because they can indicate guessing or trial-and-error changes.

When the event is generated

A USYS_CONFIG audit event is generated whenever the device writes to its configuration database through any supported path: the VIEW web interface, JSON-RPC, or the Adsdp API. The change is executed by systemd / adsdpd using the ADS-TEC libnvram implementation. libnvram calls the libaudit function audit_log_user_message(), which writes the event into audit.log. The event does not distinguish which API path triggered the change; you have to use the recorded user in the terminal field (shown as Username in the web interface) together with other logs to attribute the action. Logged operations include insert, update, and delete on configuration tables such as config and users. The res field records whether the operation ended with success or failure.

Sample audit.log entry

(1) type=USYS_CONFIG msg=audit(1760444592.644:86): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="config" operation="update" key="system_location" value="NT" condition="" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"
(2) type=USYS_CONFIG msg=audit(1760450240.952:98): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="users" operation="insert" key="" value="'test','XXX','XXX','1','XXX','1970-01-01','1970-01-01'" condition="" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"
(3) type=USYS_CONFIG msg=audit(1760450241.912:100): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="users" operation="update" key="password_argon2" value="XXX" condition="name=test" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"
(4) type=USYS_CONFIG msg=audit(1760450241.912:101): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="users" operation="update" key="password_md5" value="XXX" condition="name=test" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"
(5) type=USYS_CONFIG msg=audit(1760450241.912:102): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="users" operation="update" key="password_changetime" value="2025-10-14" condition="name=test" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"
(6) type=USYS_CONFIG msg=audit(1760450253.616:105): pid=5465 uid=0 auid=4294967295 ses=4294967295 msg='table="users" operation="delete" key="" value="" condition="name=test" exe="/usr/sbin/systemd" hostname=? addr=? terminal=admin res=success'UID="root" AUID="unset"