Skip to content

Audit Log Reference

Introduction

The ADS‑TEC Industrial IT IRF1000 and IRF3000 are industrial VPN router firewalls designed for secure remote access, network segmentation, and reliable operation in demanding environments. A key security capability of these devices is the audit log. It provides a trustworthy, tamper‑resistant record of relevant security and system events so that administrators and auditors can reconstruct who did what, when, and on which part of the system.

This chapter explains how audit logging works on the devices, what you can see in the web interface, how to download the raw log file, and what kinds of events are recorded. It is written for end users and administrators and avoids Linux internals where possible—while still providing enough context to use the feature effectively.

What is the audit log on IRF1000/IRF3000?

  • The audit log on the IRF series is built on top of the Linux standard service "auditd" (the Linux Auditing System).
  • ADS‑TEC adds device‑specific records and consistent formatting so that events are meaningful for appliance administration.
  • The device web interface provides an "Audit Log" view where you can read selected events without leaving the browser.
  • For in‑depth analysis or compliance archiving, you can download the raw audit.log file exactly as produced by auditd on the device. This will include much more events including standard internal auditid startup and configuration change events or operating system events which are not visible in the web interface.

Why this matters:

  • Provides traceability for configuration changes and administrative actions.
  • Helps detect suspicious activity (for example, repeated failed logins).
  • Supports compliance processes and incident response by offering an authoritative event history.

Where to view the audit log

You can access the audit log via the device web interface:

  1. Sign in to the IRF1000/IRF3000 web UI. All web UI accounts have permissions to view logs.
  2. Open: Diagnostics → Audit. Select one of the tabs to view a specific category.
  3. Open the Download tab to export the raw audit.log file as a .tar.gz archive.

How auditd works on the device (short version)

  • auditd is the Linux Auditing System service responsible for reliably recording security‑relevant events.
  • The IRF firmware configures auditd with rules that cover common administrative and security actions on the appliance.
  • Some events come directly from standard Linux audit facilities (for example, authentication), while other events are added or enriched by ADS‑TEC components to better represent device‑specific operations (for example, VPN state or packet filter activity).

You do not need to manage auditd rules manually. The device provides a ready‑to‑use configuration and a simple web interface for reading and exporting logs.

Best practices

  • Regularly review failed authentication attempts and unexpected configuration changes.
  • Use the raw audit.log download for incident reviews and to retain evidence according to your organization’s policy.
  • Keep device time synchronized. If you integrate with external logging or SIEM, align time zones and formats. You have to use NTP as the devices do not offer a battery buffered RTC.

Notes on event coverage and differences from generic Linux

  • On IRF devices, audit logging focuses on security‑relevant appliance actions rather than every low‑level kernel event.
  • Some entries are enriched with human‑readable fields (for example, configuration object names) to make them easier to interpret in the web UI.
  • When comparing with standard Linux audit logs, expect naming and field additions that reflect ADS‑TEC appliance context.

Important rate limits and retention:

  • The audit.log is a 50 MB ring buffer shared by all audit message types; oldest entries are overwritten once full.
  • The ring buffer uses 5 files with 10 MB each, thus the minimum storage is 40 MB and the maximum storage is 50 MB.
  • Packet filter (NETFILTER_PKT): one entry per minute per audited rule.
  • Device interface (USER_DEVICE): LINK max 20 messages/day; IO max 20 messages/hour; USB not rate‑limited.
  • Remote service (CUSTOM_REMOTE_SERVICE): max 5 messages/hour.

Audit Log to Syslog

Starting with firmware version 2.2.5, the IRF1000/IRF3000 can forward audit log entries to a syslog server. This is useful for centralized logging, long‑term retention, and compliance reporting.

To enable this:

  1. Sign in to the device web interface.
  2. Open: Diagnostics → Eventlog → Configuration.
  3. Enter the Syslog Server IP address.
  4. Enable the Include Audit Log option.
  5. Apply or save the settings.

From this point on, selected audit log entries are sent to the configured syslog server in addition to being written to audit.log on the device.

Important

Standard syslog transport is unencrypted and unauthenticated. To protect the log data in transit, place the syslog server in a trusted network segment and use IPsec or OpenVPN to encrypt the traffic between the device and the syslog server.

Audit log views in the web interface

The device web interface currently supports the following audit log views. The chapters in this document explain them in detail.

  • AUDITVIEW — Authentication audit (covers USER_LOGIN, USER_LOGOUT, USER_END)
  • AUDITCONF — Configuration audit (USYS_CONFIG)
  • AUDITSYSTEM — System audit
  • AUDITNETFILTER — Packet filter audit (NETFILTER_PKT)
  • AUDITACCESS — Access audit
  • AUDITANOMALY — Anomaly audit (no events yet as of firmware version 2.2.4)
  • AUDITDEVICE — Device audit (USER_DEVICE)
  • AUDITREMOTESERVICE — Remote service audit (CUSTOM_REMOTE_SERVICE)

The given constants represent the path on the web server of the device. i.e. https://192.168.0.254/priv/priv.php?id=AUDITNETFILTER will open the AUDITNETFILTER view.