Forum Discussion

Robert_Booth's avatar
Robert_Booth
Icon for Nimbostratus rankNimbostratus
Apr 13, 2018

Email Notification For User Logins

We have a requirement to send email notification when anyone logs into our F5 BigIP. Ive got the email notification working for failed login attempts using the audit.log and user_alert file; however, cant figure out a working unique audit message for successful logins to trigger the email.

 

BIG-IP
security
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 13, 2018

    Hello,

     

    I propose another way of doing that works well and that you can evolve. That's how I'm doing with my customer.

     

    I suppose that you send al your logs to a Syslog server (if not, ask to do so). this will allow you to concentrate all of its logs on a single server. users who do not have access to F5 can still see logs in case of problems. Additional you can archive it...

     

    if your client does not have a syslog server you have a lot of free solution that will allow you to concentrate, correlate your logs and generate graphs by parsing them (ElasticSearch: kibana for example).

     

    So when you send your logs to your syslog servers you can easly create notification (mail, snmp, Alert ...), you can create mail alert for User access, login failure... And you can create some alerte in case of failover, crash, (all behaviour that you need)...

     

    could this solution suit you?

     

    Regards