Orchestrator Logs
To access the Orchestrator audit logs:
-
Log in to Orchestrator and navigate to Orchestrator > Orchestrator Server > Tools > Audit Logs.
-
Filter the logs by Log Level, Appliance, date, User, or search text.
-
Export the logs to an external Syslog server or SIEM (Security Information and Event Management) system, if necessary.
Syslog Logs
Description: These logs are exported from Orchestrator using syslog protocols and contain information about general system operations, user actions, and alarms.
Sample Log:
The following log is one example of a syslog from the Orchestrator.
Jan 22 21:00:44 172.16.3.20 1 2025-01-23T05:00:44.379Z Orchestrator AUDIT_LOG - -1
[SP@23867 id="4920" user="admin" nepk="" name="Add remote log receiver"
description="Add remote log receiver" taskStatus="Completed"
startTime="1737608444235" endTime="1737608444235" logLevel="Info" result="New
remote log receiver with id [1\] added"][meta sequenceId="4920"]
INFO||Add remote log receiver|admin|4920|2025-01-23T05:00:44.375052Z|||New remote log receiver with id [1]
added|Orchestrator|
Orchestrator Audit Log Data
| Field | Type | Description |
|---|---|---|
| structured data id | string | HPE Aruba Networking enterprise number “SP@23867.” |
| id | number | The unique ID for the audit log event. |
| user | string | Either the person who or the system that originated the action. |
| nepk | string | If the audit log event was an action performed on an appliance, this field shows the unique ID of the appliance. |
| name | string | The name of the action performed in the audit log event. |
| description | string | A description of the action performed in the audit log event. |
| taskStatus | enum | Indicates the status of the action. NOT_STARTED (0), IN_PROGRESS (1), or COMPLETED (2). |
| startTime | epoch milliseconds |
The time in UTC when the action started. |
| endTime | epoch milliseconds |
The time in UTC when the action ended. |
| logLevel | enum | Indicates the type of log. DEBUG (1), INFO (2), or ERROR (3). |
| result | string | Indicates the result of the action and usually contains detailed data about the action that was taken. |
Continue to EdgeConnect Appliance Logs.