Exceptions for Audit Logging

Use the commands log-audit-exception-create, log-audit-exception-delete, and log-audit-exception-show are used to control which CLI, shell and vtysh commands are subject to auditing.

If Netvisor ONE subjects a command to auditing, Netvisor ONE logs the command in the audit log and sends it to the TACACS+ server as authorization and accounting messages.

CLI (network-admin@Spine1) > log-audit-exception-create

	Create an audit logging exception.
cli\|shell\|vtysh	Specify the type of audit exception.
pattern pattern-string	Specify a regular expression to match exceptions.
any\|read-only\|read-write	Specify the access type to match exceptions.
scope local\|fabric	Specify the scope of exceptions.

CLI (network-admin@Spine1) > log-audit-exception-delete

	Delete an audit logging exception.
cli\|shell\|vtysh	Specify the type of audit exception.
pattern pattern-string	Specify a regular expression to match exceptions.
any\|read-only\|read-write	Specify the access type to match exceptions.

CLI (network-admin@Spine1) > log-audit-exception-show

	Display audit logging exceptions.
cli\|shell\|vtysh	Display the type of audit exception.
pattern pattern-string	Display a regular expression to match exceptions.
any\|read-only\|read-write	Display the access type to match exceptions.
scope local\|fabric	Display the scope of exceptions.

By default, Netvisor ONE audits every command except for read-only CLI commands and ^/usr/bin/nvmore which is the pager for the Netvisor ONE CLI:

CLI (network-admin@switch) > log-audit-exception-show

switch type pattern access scope

------ ----- ---------------- --------- -----

switch cli read-only local

switch shell ^/usr/bin/nvmore any local

To enable auditing of ALL CLI commands, you can delete the cli/read-only exception:

CLI (network-admin@switch) > log-audit-exception-delete cli read-only

Modifying User Roles

You can add privileges to a user by adding new parameters available for roles. To add shell access to a user’s role, use the following syntax:

CLI (network-admin@switch) > role-create

name name-string	Specify a name for the user role.
scope local\|fabric	Specify a scope for the user role.
One or more of the following options:
access read-only\|read-write	Specify the type of access for the user role. The default is read-write.
running-config\|no-running-config	Specify if the user role allows access to the switch running configuration.
shell\|no-shell	Specify if the user role allows access to the shell.
sudo\|no-sudo	Specify if the user role allows the sudo command.

The new parameters are also available for the role-modify command.