Central Activity Logging - Arc protection - Bay control and measurement - Motor protection - Transformer protection - 2 winding - Busbar differential protection (low impedance) - Feeder protection - Voltage regulation - Busbar protection (voltage and frequency) - Capacitor bank protection - Interconnection protection - Power management/Load shedding - Back-up protection - Cyber Security Deployment Guideline - SSC600 Smart substation control and protection - 1.0 FP4 - IEC - ANSI

The audit trail events can be reported from the relay to a Central Activity Logging (CAL) server in Syslog format. The relay is the CAL client and it sends the events to a CAL server which can be SDM600 or any other tool capable of handling the Syslog format.

There can be a maximum of two CAL servers connected to the protection relay at any time. To enable logging of the audit trail events to a Syslog server, the User Activity Logging feature needs to be enabled in the protection relay and parameters need to be set for each UAL server where it is required to send the audit trail events.

Table 1. Configuring Central Activity Logging
Parameter	Options	Description
Enable UAL	Enable	Enables user activity logging at the CAL server
Enable UAL	Disable (Default)	Disables user activity logging at the CAL server
Server IP	User-entered value	IP address of the CAL server
Communication type	UDP (Default)	Uses UDP for communication with the CAL server
Communication type	TCP	Uses TCP for communication with the CAL server
Communication port	514 (Default)	Port used for UDP
Communication port	1468	Port used for TCP

This can be done in Main menu > Configuration > User Activity Log from LHMI, WHMI or Parameter Setting in PCM600. The CAL server also needs to be configured with the details of the relay.

Port number: Same as the port number set in the relay
IP address: IP address of the relay from which the CAL server receives the log events

Note: For the overall system security, it’s important to ensure secure communication between SSC600 and CAL server. More information about system hardening can be found in Basic system hardening rules.

The events logged into the Syslog server have the following information:

Date and time when the event occurred
Event ID: Each event has a unique security ID
Serial number (SOE number): This is a sequential number which indicates the sequence of occurrence of the event
User and role name: The user who performed the event and the role associated with that user
Severity: Whether it is a security event or alert
Extra Info: Contains additional useful information about the event

Note: If an event occurs while communication with the CAL server is inaccessible, the events are not retransmitted. In this case, use Event Viewer in PCM600 to read out the activity logging from the protection relay.

Note: The protection relay supports Syslog version 1.