Forum Discussion

PabloSalvadorM_'s avatar
PabloSalvadorM_
Icon for Altostratus rankAltostratus
Oct 14, 2014

Check active admin user sessions

Hello,   so far I've been unable to find a way to see the active sessions in the webgui. The "w" command on shell only shows connections through cli (ssh) and not connections through the gui.   ...
application delivery
BIG-IP Access Policy Manager (APM)
LTM
management
security
TMOS
TMSH
  • Paulius's avatar
    Paulius
    Feb 07, 2023

    Irre_Levant I believe the only option here is to correlate the data from multiple sources rather than one command that provides everything. The following should allow you to pull the audit logs but I don't believe a command exists to look at the output of netstat.

    https://support.f5.com/csp/article/K41550738

Gonzalex_330537's avatar
Gonzalex_330537
Icon for Cirrostratus rankCirrostratus
Oct 30, 2017

Hi Pablo.

 

You could use netstat -na | grep 192.168.0.11 | grep ESTABLISHED

 

This will show you the active sessions regardless of the user currently logged in. You could also get more info from the /var/log/audit logs. Below is an example of what you would tipically see when a user logs in:

 

AUDIT - user admin - RAW: httpd(mod_auth_pam): user=admin(admin) partition=[All] level=Administrator tty=/sbin/nologin host=192.168.0.11 attempts=1 start="Mon Oct 30 14:22:13 2017" end="Mon Oct 30 14:47:58 2017"

 

Having these two pieces, you could cross match the IP address.

 

Hope this helps.