For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

heskez_36146's avatar
heskez_36146
Icon for Nimbostratus rankNimbostratus
Aug 17, 2015

F5 APM retrieve information for a specific username from archived audit tracks

Hi,   I'm currently facing a nice challenge. One wants to know whether a specific user has logged on to our remote portal, within a month or even longer ago.. Our remote portal is to be accessed ...
audit
BIG-IP Access Policy Manager (APM)
log file
security
ucs
Seth_Cooper's avatar
Seth_Cooper
Icon for Employee rankEmployee
Aug 17, 2015

Hi Erik,

 

Your best bet for the future is to configure remote syslog on the bigip and have the logs sent off box to the syslog server. We have some integrations with SPLUNK.

 

For the issue you have now, the information will be stored in /var/log/apm. The audit log shows logins for the bigip admin UI or CLI. It doesn't look like the UCS contains the logs files as the UCS is a configuration backup.

 

Seth