Changes to these working-configuration objects generate log entries:

• Firewalls
• Policies
• Rule lists
• Address lists
• Port lists
• Schedules
• Snapshots

These actions also generate log entries:

• Add/edit BIG-IQ Network Security system roles. Tracking role modification provides auditing for the assignment of users to roles.
• Create/cancel device discovery and reimport.
• Delete previously-discovered device.
• Create/delete deployment task.
• Create difference task.
• Create/delete snapshot.
• Edit of system information (such as host name and internal self IP).

In high-availability (HA) configurations, each node maintains its own audit log. Entries are synced after the HA configuration is set. If you have entries on the primary node and then configure HA, the previously-generated entries on the primary will not be replicated to the standby node; new entries will be replicated.

All deletions, whether performed manually through the Audit Log viewer or performed as part of a delete and archive operation, are not deleted on the standby node.

Also, archives are configured separately on each node.

The firewall audit log viewer displays the following properties for each entry.

1. To examine audit logs using SSH, log in to BIG-IQ Network Security with Administrator or Security_Manager credentials.
2. Navigate to the audit log location: /var/log/audit.
3. Examine files with the naming convention: audit.n.txt. where n is the log number.
4. Once you have located the logs, you can view or save the log locally through a method of your choice.

1. Log in to BIG-IQ Network Security with Administrator or Security_Manager credentials.
2. Below Network Security, click Audit Logs to display the viewer.
3. To display differences between object generations, click an object in the Object Name column,which open the Difference Viewer. Areas of differences are highlighted in gold. Additions to a generation are highlighted in green. Textual JSON appears for each difference found.
4. When you are finished, click Close.

1. Log in to BIG-IQ Network Security.
2. Below Network Security, click Audit Logs
3. In the Filter field, type the information specific to the object you want to filter on, and click Apply.

   Option	Description
   Client IP	Type the client IP address in the filter. Note that when a task is not initiated by a user, the entry in the Client IP column is blank.
   Time (mix of letters and numbers)	Type a date/time in any of the following formats: mmm dd yyyy hh:mm:ss. Example: Jan 7 2014 8:30:00 ddd mmm dd yyyy hh:mm. Example: Thu Jan 16 2014 11:01 ddd mmm dd yyyy hh:mm:ss. Example: Thu Jan 16 2014 11:13:50 Formats are highly browser-dependent. Other formats might appear to filter successfully, but are not supported. You must include both a date and a time. Entering a single date/time results in a filter that displaysall entries from the specified date/time to the current date/time. To filter on a range of times, enter the dates/times in one of the supported formats, separated by a hyphen. Example: jan 21 2014 11:04-jan 21 2014 11:05.
   Time (numbers only)	Type a date/time in any of the following formats: m/d hh:mm:ss. Example: 1/1 12:14:15 mm/dd hh:mm:ss. Example: 01/01 12:14:15 m/d hh:mm. Example: 1/1 12:14 m/d h:mm. Example: 1/1 2:14 mm/dd hh:mm. Example: 01/01 12:14 mm/dd/yy hh:mm:ss. Example: 01/01 12:14:15 m/d/yy hh:mm:ss. Example: 1/1/14 12:14:15 mm/dd/yy hh:mm. Example: 01/01/14 12:14 m/d/yy hh:mm. Example: 1/1/14 12:14 mm/dd/yyyy hh:mm:ss. Example: 1/1/2014 12:14:15 You must include both a date and a time. Typing a single date/time results in a filter displaying all entries from the specified date/time to the current date/time. To filter on a range of times, type the dates/times in one of the supported formats, separated by a hyphen. Example: 1/1 12:14:15-1/1 12:14:18.
   Node	Type the node name in the filter.
   User	Type the user in the filter.
   Object Name	Type the name of the object in the filter. If a partition name is displayed, do not include it in the filter. For example, you would specify /Common/AddressList_4 as AddressList_4. Note that entries in the Object Name column are links to the JSON representing the object. If the object does not have a name, the system places a dash in the column. The dash is also a link to the JSON.
   Type	Type the type in the filter. Note that WC stands for working configuration.
   Action	Type the action in the filter.
   Version	Type the version number in the filter.

1. Log in to BIG-IQ Network Security with Administrator or Security_Manager credentials.
2. At the top left of the screen, below Network Security, click Audit Logs to view the audit log.
3. Delete one or multiple entries as specified:

   To delete:	Do this:
   A single entry	Select the check box for the entry you want to delete and then click Remove. You will not receive a confirmation dialog box.
   All entries stored on this BIG-IQ system	Select the check box in the header row and then click Remove. In the confirmation dialog box, click Yes to confirm that you want to delete all entries. Important: This action removes all entries, not just those visible in the viewer page.
   Multiple entries	Combine selecting with the Shift key, and then click Remove. You will not receive a confirmation dialog box.
   A filtered batch of entries	Type a text string in the Filter field at the top of the page and click Apply. The result after applying the filter is a batched set of entries that match the criteria. Select the check box at the top of the table in the header row and click Remove. The batch of entries is removed. Note that if you delete a large batch of entries, the operation may take some time if the system has a lot of entries. Also, you must keep the Audit Logs viewer open the entire time.

1. Log in to BIG-IQ Network Security.
2. Below Network Security, click Audit Logs.
3. Hover over the Firewall header and click the gear icon to display the settable audit log properties.
4. Complete the properties and status settings, and click Save.

   Property	Description
   Days to keep entries	Default is 30 days. The field must contain an integer between 1 and 366.
   Check expiration at this time	Contains the hour and minute when expirations on entries will be checked. You can type the hour and the minute manually (in the format hh:mm). Or, you can click in the field to view and edit in the Choose Time dialog box. Adjust the Hour and Minute sliders to reflect the desired hour and minute, and then click Done.
   When entries expire	Controls whether entries are deleted from the audit log when they expire, or deleted from the audit log but archived to the audit log archive. Select Delete to delete the entry. (This action is permanent; you cannot get a deleted entry back.) Select Delete and Archive to delete the entry but archive it for future reference. Expired entries are saved to a predefined file at /var/log/firewall/archive-audit.0.txt.
   Next run time	Informational, read-only setting, indicating the next time entries will be archived. Run time is expressed in the format: ddd mmm dd yyyy hh:mm:ss. Example: Tue Jan 28 2014 02:50:00.
   Last run time	Informational, read-only setting, indicating the last time entries were archived. Run time is expressed in the format: ddd mmm yyyy hh:mm:ss. Example: Tue Jan 28 2014 02:50:00.
   Entries expired at last run time	Number of entries that expired at the last run time.
   Last Error	Informational, read-only setting. The field contains the text No error or the error text for any errors found.
   Last Error Time	Informational, read-only setting. Time in the field is expressed in the format: ddd mmm dd yyyy hh:mm:ss Example: Fri Jan 17 2014 23:50:00.

1. Using SSH, log in to the BIG-IQ Network Security device with administrator credentials.
2. Navigate to the restjavad log location: /var/log.
3. Examine files with the naming convention: restjavad-audit.n.log. where n is the log number.
4. Once you have located it, you can view or save the log locally through a method of your choice.