For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Ho's avatar
Mike_Ho
Icon for Cirrus rankCirrus
Jul 25, 2008

How unique are session IDs supposed to be?

Hiya, newbie Firepass (FP) user here. I'm auditing logins to our FPs via syslogs and I was hoping I could rely on the "Sid" reported during logon and logoff events to be good ways to track sessions. ...
BIG-IP Access Policy Manager (APM)
remote access
security
mal_57091's avatar
mal_57091
Icon for Nimbostratus rankNimbostratus
Jul 29, 2008
Hi Michael,

 

 

Welcome aboard! FirePass uses an abbreviated SessionID when sending logs out via Syslog/System Log facility. It used to send out the full SID but a few versions back this got changed to the abbreviated format. Probably your best bet is to export the Session Report (or Logon Report) from the AdminUI cause that should give you what you need.

 

 

In regards to what the SID is a hash of - your guess is as good as mine...that would come under the category of 'F5 black magic'.

 

 

Cheers,

 

Mal