Audit Log Data via IPFIX

SonicOS 8.2.2 introduces the ability to export firewall audit log data to NSM and Sonic Platform using IPFIX. This enables centralized audit log collection from multiple firewalls, allowing administrators to monitor configuration changes remotely without directly accessing the individual devices.

Audit logs capture all administrative configuration changes, including:

• Parameter modified
• Timestamp
• User identity
• Source of the change
• Old and new values

These records are exported as IPFIX flow events using a new dedicated IPFIX Template ID 284.

For configuring IPFIX, refer to IPFIX Enhancements.