Skip to content

Remote Service - VPN

Remote Service - VPN

Introduction

CUSTOM_REMOTE_SERVICE audit events report Big‑LinX VPN requests and VPN state changes on ADS‑TEC IRF1000 and IRF3000 devices. They document when the device requests to bring the VPN tunnel up or down and when the tunnel actually becomes connected or not connected. This supports change tracking, incident analysis, and SOC correlation for remote service activity in OT networks. Watch for unexpected connected or up events outside maintenance windows, rapid up/down toggling, or frequent reload states, because these patterns can indicate misuse, misconfiguration, or instability. Event emission is rate‑limited to five messages per hour, so always correlate with other logs when VPN activity is very frequent.

Webinterface view

The VIEW web interface shows these entries under Remote service audit in the Remote Service - VPN section. It lists the parsed content of the CUSTOM_REMOTE_SERVICE events in column form and hides internal auditd metadata.

Field Description Example
Date Local device date derived from the audit timestamp. 10/14/25
Time Local device time derived from the audit timestamp. 16:57:36
Operation Operation from the audit message. Values: vpn_request, vpn_state_change. vpn_state_change
State Requested or resulting VPN state. Values: reload, up, down, connected, not_connected. connected
Requester Source of the request. Currently not set and displayed as (unknown). (unknown)

The list matches the example in the screenshot: vpn_request with states reload, up, and down, and vpn_state_change with states connected and not_connected, with the requester column always showing (unknown) at the moment. The web view focuses on readability for operators and does not display internal auditd fields such as pid, uid, auid, or ses.

Explanation of the raw audit.log entries

Each record in /var/log/audit/audit.log is a standard auditd line with type CUSTOM_REMOTE_SERVICE. The key data for SIEM or SOC correlation is inside the msg='…' part of the record. Generic auditd fields are only summarized here; for full semantics please refer to the official auditd documentation.

Field Description Example
type Audit record type. Identifies this as a remote service VPN event. CUSTOM_REMOTE_SERVICE
msg=audit(ts:serial) Audit header with seconds.microseconds since epoch and a serial ID. audit(1760453856.061:164)
pid Process ID of the emitter (statusd). 6964
uid Effective UID of the emitting process. 0
auid Audit user ID (login UID). 4294967295
ses Audit session ID. 4294967295
msg.operation Operation field. Maps to VIEW "Operation". Values: vpn_request, vpn_state_change. vpn_request
msg.state State field. Maps to VIEW "State". Values: reload, up, down, connected, not_connected. connected
msg.requester Source of the request. Currently not set; appears as (unknown). Maps to VIEW "Requester". (unknown)
msg.exe Executable that emitted the event. /usr/sbin/statusd
hostname Hostname field from auditd. Not used here. ?
addr Address field from auditd. Not used here. -
terminal Terminal field from auditd. Not used here. ?
res Result flag from the emitter. For these events usually success. success
UID Textual UID resolved by auditd. root
AUID Textual AUID resolved by auditd. unset

SOC guidance:

  • Alert on vpn_state_change with state connected outside approved maintenance or service windows.
  • Alert when a vpn_request with state up is not followed by a vpn_state_change with state connected within the expected time window, as this can indicate connection problems.
  • Watch for repeated reload states or fast up/down cycles, which can indicate configuration issues or unstable links.
  • Correlate VPN audit events with administrator logins, change tickets, and other system logs. Consider the five‑events‑per‑hour throttle when building correlation rules and counters.

When the event is generated

The daemon statusd generates CUSTOM_REMOTE_SERVICE events by using the libaudit function audit_log_user_message(). It controls Big‑LinX VPN connections and writes an audit record whenever the device requests a VPN action or observes a VPN state change.

Operations:

  • vpn_request: the device requested a change of the VPN state.
  • vpn_state_change: the observed VPN state changed.

States:

  • reload: the device fetches current configuration and task data from the Big‑LinX servers.
  • up: the device requests to establish the VPN tunnel.
  • down: the device requests to tear down the VPN tunnel.
  • connected: the VPN tunnel is established and connected to Big‑LinX.
  • not_connected: the VPN tunnel is down and no longer connected.

The requester field is currently not filled and is shown as (unknown) in all outputs. Emission is throttled to five CUSTOM_REMOTE_SERVICE messages per hour to protect the audit.log file. Very bursty VPN activity may therefore not produce a one‑to‑one event stream in the audit log and must be correlated with other sources such as system logs or VPN diagnostics.

Sample audit.log entry

(1) type=CUSTOM_REMOTE_SERVICE msg=audit(1760362567.867:32): pid=7843 uid=0 auid=4294967295 ses=4294967295 msg='operation="vpn_request" state="reload" requester=(unknown) exe="/usr/sbin/statusd" hostname=? addr=- terminal=? res=success'UID="root" AUID="unset"
(2) type=CUSTOM_REMOTE_SERVICE msg=audit(1760453848.569:163): pid=6964 uid=0 auid=4294967295 ses=4294967295 msg='operation="vpn_request" state="up" requester=(unknown) exe="/usr/sbin/statusd" hostname=? addr=- terminal=? res=success'UID="root" AUID="unset"
(3) type=CUSTOM_REMOTE_SERVICE msg=audit(1760453856.061:164): pid=6964 uid=0 auid=4294967295 ses=4294967295 msg='operation="vpn_state_change" state="connected" exe="/usr/sbin/statusd" hostname=? addr=- terminal=? res=success'UID="root" AUID="unset"
(4) type=CUSTOM_REMOTE_SERVICE msg=audit(1760454019.474:169): pid=6964 uid=0 auid=4294967295 ses=4294967295 msg='operation="vpn_request" state="down" requester=(unknown) exe="/usr/sbin/statusd" hostname=? addr=- terminal=? res=success'UID="root" AUID="unset"
(5) type=CUSTOM_REMOTE_SERVICE msg=audit(1760454019.674:170): pid=6964 uid=0 auid=4294967295 ses=4294967295 msg='operation="vpn_state_change" state="not_connected" exe="/usr/sbin/statusd" hostname=? addr=- terminal=? res=success'UID="root" AUID="unset"