Setting up cybersecurity event logs and alarms
The event log can be used to monitor user logins and user account lockouts. The record limit for the event log is 5,000 by default. When the limit is reached, new records overwrite older ones.
To be notified when the Event Log record limit is approaching, see “Assigning a designated reader for event log notification”.
To extend record retention, offload information to syslog or a protected storage or retention location, see “Configuring Syslog network settings using ION Setup”.
Required for this procedure:
Meter connection using ION Setup.
- Open ION Setup > select the meter > Setup Assistant.
- Security > Security Mode > Edit. The Open Security Configuration file dialog box opens.
- Select the Security Configuration File (.scf) that contains
the current meter settings and click Open.
The Standard Options or Advanced Options dialog box opens.NOTE: Open the security log file to determine the .scf file you want. See “Cybersecurity configuration” for more information.
- Click Next to navigate to the Select protocol lockout options screen:
- Click Events. The Event Priorities dialog box opens:
- Leave default values or enter values for each event priority
according to your reporting requirements:
Priority Description Value range
Not recorded in the event log.
Recorded in the event log. Event log cut-off range. Will not appear in Event Log reports or syslog records.
1 to 5
Recorded in the event log.
6 to 63
Recorded in the event log. Produces alarm low alarm.
64 to 127
Recorded in the event log. Produces medium alarm.
128 to 191
Recorded in the event log. Produces alarm low alarm. Recorded in syslog records.
192 to 255
- Click OK.
- Click Next.
- Click Finish. A Confirmation message box opens.
- Click Yes. The Save As dialog box opens.
- Save the Security Configuration File (.scf) with a unique file name to avoid overwriting default Security Configuration files.
- Click Exit. The Device Configuration Checklist message box opens.
- Click Exit.