# Asterisk Project : Security Log File Format

Added by mdavenport , edited by mdavenport on Aug 31, 2010

The beginning of each line in the log file is the same as it is for other logger levels within Asterisk.

    [Feb 11 07:57:03] SECURITY[23736] res_security_log.c: <...>

The part of the log entry identified by \<...\> is where the security event content resides. The security event content is a comma separated list of key value pairs. The key is the information element type, and the value is a quoted string that contains the associated meta data for that information element. Any embedded quotes within the content are escaped with a backslash.

INFORMATION_ELEMENT_1="IE1 content",INFORMATION_ELEMENT_2="IE2 content"

The following table includes potential information elements and what the associated content looks like:

- IE: SecurityEvent
  Content: This is the security event sub-type.
  Values: FailedACL, InvalidAccountID, SessionLimit, MemoryLimit, LoadAverageLimit, RequestNotSupported, RequestNotAllowed, AuthMethodNotAllowed, ReqBadFormat, UnexpectedAddress, ChallengeResponseFailed, InvalidPassword

- IE: EventVersion
  Content: This is a numeric value that indicates when updates are made to the content of the event.
  Values: Monotonically increasing integer, starting at 1

- IE: Service
  Content: This is the Asterisk service that generated the event.
  Values: TEST, SIP, AMI

- IE: Module
  Content: This is the Asterisk module that generated the event.
  Values: chan_sip

- IE: AccountID
  Content: This is a string used to identify the account associated with the event. In most cases, this would be a username.

- IE: SessionID
  Content: This is a string used to identify the session associated with the event. The format of the session identifier is specific to the service. In the case of SIP, this would be the Call-ID.

- IE: SessionTV
  Content: The time that the session associated with the SessionID started.
  Values: <seconds><microseconds> since epoch

- IE: ACLName
  Content: This is a string that identifies which named ACL is associated with this event.

- IE: LocalAddress
  Content: This is the local address that was contacted for the related event.
  Values: <Address Family>/<Transport>/<Address>/<Port>
  Examples: -> IPV4/UDP/192.168.1.1/5060 -> IPV4/TCP/192.168.1.1/5038

- IE: RemoteAddress
  Content: This is the remote address associated with the event.
  Examples: -> IPV4/UDP/192.168.1.2/5060 -> IPV4/TCP/192.168.1.2/5038

- IE: ExpectedAddress
  Content: This is the address that was expected to be the remote address.
  Examples: -> IPV4/UDP/192.168.1.2/5060 -> IPV4/TCP/192.168.1.2/5038

- IE: EventTV
  Content: This is the timestamp of when the event occurred.
  Values: <seconds><microseconds> since epoch

- IE: RequestType
  Content: This is a service specific string that represents the invalid request

- IE: RequestParams
  Content: This is a service specific string that represents relevant parameters given with a request that was considered invalid.

- IE: AuthMethod
  Content: This is a service specific string that represents an authentication method that was used or requested.

- IE: Challenge
  Content: This is a service specific string that represents the challenge provided to a user attempting challenge/response authentication.

- IE: Response
  Content: This is a service specific string that represents the response received from a user attempting challenge/response authentication.

- IE: ExpectedResponse
  Content: This is a service specific string that represents the response that was expected to be received from a user attempting challenge/response authentication.