May 19 02:00:00.100: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 10.0.7.10] [localport: 22] at 02:00:00 UTC Tue May 19 2026
May 19 02:00:02.210: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 192.168.1.5] [localport: 21111] [Reason: Login Authentication Failed - BadPassword] at 02:00:02 UTC Tue May 19 2026
May 19 02:00:05.448: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: admin] [Source: 192.168.1.5] [localport: 21111] [Reason: Login Authentication Failed - BadPassword] [ACL: sl_def_acl] at 02:00:05 UTC Tue May 19 2026
May 19 02:01:03.451: %SYS-5-CONFIG_P: Configured programmatically by process SEP_webui_wsma_http from console as admin on vty0
May 19 02:02:10.001: %AAA-6-AAA_ACCOUNTING_MESSAGE: start:10.0.7.10@pts/0:admin:
May 19 02:02:13.346: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/0:admin:guestshell enable (SUCCESS)
May 19 02:02:13.350: %VMAN-2-INSTALL_STATE: Installing virtual service 'guestshell+'
May 19 02:02:42.121: %VMAN-5-PACKAGE_SIGNING_LEVEL_ON_INSTALL: Package 'guestshell.ova' for service container 'guestshell+' is 'Cisco signed', signing level allowed is 'Cisco signed'
May 19 02:02:44.122: %VMAN-2-ACTIVATION_STATE: Activating virtual service 'guestshell+'
May 19 02:03:20.000: %VMAN-2-GUESTSHELL_ENABLED: The guest shell has been enabled. The command 'guestshell' may be used to access it, 'guestshell destroy' to remove it.
May 19 02:03:21.213: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/0:admin:guestshell (SUCCESS)
May 19 02:05:33.989: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/0:admin:guestshell destroy (SUCCESS)
May 19 02:05:34.111: %VMAN-2-ACTIVATION_STATE: Deactivating virtual service 'guestshell+'
May 19 02:05:37.222: %VMAN-2-INSTALL_STATE: Destroying virtual service 'guestshell+'
May 19 02:05:39.400: %VMAN-2-INSTALL_STATE: Successfully destroyed virtual service 'guestshell+'
May 19 02:06:00.101: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:enable (SUCCESS)
May 19 02:06:01.220: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:terminal length 0 (SUCCESS)
May 19 02:06:02.330: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:terminal width 0 (SUCCESS)
May 19 02:06:05.101: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show clock (SUCCESS)
May 19 02:06:06.201: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show file systems (SUCCESS)
May 19 02:06:07.302: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:dir bootflash: (SUCCESS)
May 19 02:06:08.403: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show platform software status control-processor brief (SUCCESS)
May 19 02:06:09.504: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show running-config (SUCCESS)
May 19 02:06:10.605: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show tacacs (SUCCESS)
May 19 02:06:11.706: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show cdp neighbors (SUCCESS)
May 19 02:06:12.807: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:show cdp neighbors detail (SUCCESS)
May 19 02:07:00.100: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ssh 10.18.86.24 (SUCCESS)
May 19 02:07:00.500: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ssh 10.18.86.25 (SUCCESS)
May 19 02:07:01.100: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ssh 10.18.86.22 (SUCCESS)
May 19 02:07:01.600: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ssh 4.0.1.9 (SUCCESS)
May 19 02:07:02.200: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ssh 10.20.30.20 (SUCCESS)
May 19 02:07:03.300: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ping 10.20.30.20 (SUCCESS)
May 19 02:07:04.400: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:ping 4.1.1.2 source Loopback 10 (SUCCESS)
May 19 02:07:05.500: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.0.7.10@pts/5:admin:telnet 4.1.1.1 22 (SUCCESS)
May 19 02:08:00.001: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>8</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:08:00.001Z</absoluteTime></when></changeInfo><changeItem><context></context><enteredCommand><cli>ip http secure-server </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:08:02.100: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>8</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:08:02.100Z</absoluteTime></when></changeInfo><changeItem><context></context><enteredCommand><cli>line vty 0 4 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:08:03.200: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>8</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:08:03.200Z</absoluteTime></when></changeInfo><changeItem><context><cli>line vty 0 4 </cli></context><enteredCommand><cli>no access-class TELNET_access in </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:08:04.300: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>8</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:08:04.300Z</absoluteTime></when></changeInfo><changeItem><context><cli>line vty 0 4 </cli></context><enteredCommand><cli>access-class TELNET_access in </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:09:00.001: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>9</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:09:00.001Z</absoluteTime></when></changeInfo><changeItem><context></context><enteredCommand><cli>interface Tunnel 10 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:09:01.100: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>9</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:09:01.100Z</absoluteTime></when></changeInfo><changeItem><context><cli>interface Tunnel 10 </cli></context><enteredCommand><cli>tunnel source Loopback0 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:09:02.200: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>9</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:09:02.200Z</absoluteTime></when></changeInfo><changeItem><context><cli>interface Tunnel 10 </cli></context><enteredCommand><cli>tunnel destination 10.10.12.2 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:09:03.300: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>9</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:09:03.300Z</absoluteTime></when></changeInfo><changeItem><context><cli>interface Tunnel 10 </cli></context><enteredCommand><cli>ip address 10.10.12.1 255.255.255.252 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:10:00.101: %HA_EM-6-LOG: catchall: request platform software package describe file bootflash:--filename=/(bash)n
May 19 02:10:01.202: %HA_EM-6-LOG: catchall: request platform software package describe file bootflash:--filename=$(bash)n
May 19 02:11:00.100: %HA_EM-6-LOG: catchall: show logging
May 19 02:11:10.200: %HA_EM-6-LOG: catchall: clear logging
May 19 02:11:15.300: %HA_EM-6-LOG: catchall: exit
May 19 02:12:00.001: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin  logged command:<?xml version="1.0" encoding="UTF-8"?><configLoggerMsg version="1.0"><configChanged><changeInfo><sessionId>10</sessionId><user>admin</user><telnet><srcIP>10.0.7.10</srcIP><vtyName>vty0</vtyName></telnet><when><absoluteTime>2026-05-19T02:12:00.001Z</absoluteTime></when></changeInfo><changeItem><context></context><enteredCommand><cli>no interface Loopback 100 </cli></enteredCommand><prcResultType><prcSuccess><change>PRC_CONFIG_CHANGE</change><changeMode>PRC_IMMEDIATE</changeMode></prcSuccess></prcResultType></changeItem></configChanged></configLoggerMsg>
May 19 02:12:07.200: %HA_EM-6-LOG: catchall: clear logging
May 19 02:12:14.300: %HA_EM-6-LOG: catchall: exit