Issue
On the current M580 CPU FWs the syslog messages sent by the CPU are not aligned with the Syslog messages documented in the reference Manual : Modicon Controllers Platform - Cyber Security - Reference Manual ( EIO0000001999.06 )
Customer wants to know what are the syslog message list generated by the M580 CPU.

Product Line
M580 CPU HSBY and Standalone.
Only Standalone Syslog Event messages will be available. No specific HSBY Syslog event messages are currently available.

Environment
Firmware 3.10

Resolution
The Syslog M580 CPU syslog messages – V2.pdf document contains the Syslog messages generated by the CPU syslog and sent to a syslog server.

Here is below the legend to read the document (extract from the document: Modicon Controllers Platform - Cyber Security - Reference Manual: EIO0000001999.06)

Events Logged

Syslog message structure:

Field	Description
PRI	Facility and severity information (description provided in following tables).
VERSION	Version of the syslog protocol specification (Version = 1 for RFC 5424.).
TIMESTAMP	Time stamp format is issued from RFC 3339 that recommends the following ISO8601 Internet date and time format: YYY-MM-DDThh:mm:ss.nnnZ NOTE: -, T, :, . , Z are mandatory characters and they are part or the time stamp field. T and Z need to be written in uppercase. Z specifies that the time is UTC. Time field content description: YYY Year MM Month DD Day hh Hour mm Month ss Second nnn Fraction of second in millisecond (0 if not available)
HOSTNAME	Identifies the machine that originally sent the syslog message: fully qualified domain name (FQDN) or source static IP address if FQDN is not supported.
APP-NAME	Identifies the application that initiates the syslog message. It contains information that allows to identify the entity that sends the message (for example, subset of commercial reference).
PROCID	Identifies the process, or entity, or component that sends the event. Receives NILVALUE if not used.
MSGID	Identifies the type of message on which the event is related to, for example HTTP, FTP, Modbus. Receives NILVALUE if not used.
MESSAGE TEXT	This field contains several information: Issuer address: IP address of the entity that generates the log. Peer ID: Peer ID if a peer is involved in the operation (for example, user name for a logging operation). Receives null if not used. Peer address: Peer IP address if a peer is involved in the operation. Receives null if not used. Type: Unique number to identify a message (description provided in following tables). Comment: String that describes the message (description provided in following tables).

Syslog message facility values as per RFC 5424 specification associated with events type:

Facility value	Description
0	Kernel messages.
1	User-level messages.
2	Mail system.
3	System daemons.
4	Security / authorization messages.
5	Messages generated internally by syslog.
6	Line printer subsystem.
7	Network news subsystems.
8	UUCP subsystem
9	Clock daemon.
10	Security / authorization messages.
11	FTP daemon.
12	NTP subsystem.
13	Log audit.
14	Log alert.
15	Clock daemon.
16...23	Local use 0...7.

Syslog message severity values as per RFC 5424 specification associated with events type:

Severity value	Keyword	Description
0	Emergency	System is unusable.
1	Alert	Action must be taken immediately.
2	Critical	Critical conditions.
3	Error	Error conditions.
4	Warning	Warning conditions.
5	Notice	Normal but significant condition.
6	Informational	Informal messages.
7	Debug	Debug-level messages.

Publié pour:Schneider Electric Belgium