Forum Discussion

Alscion_68122's avatar
Alscion_68122
Icon for Nimbostratus rankNimbostratus
Nov 22, 2011

iControl command in audit log

Hi,

 

 

When i enter a command in tmsh, i see it the audit log, and so in my remote syslog to. For example, when i load my conf with the command tmsh load sys config and I can see in the syslog the corresponding log: module=(tmos) status=[Command OK] cmd_data=load sys config

 

 

How can I have the same type of log with a command asked by iControl? I want the command passed with a remote server using iControl is logged in audit as the same. Does anybody has an idea?

 

 

Thanks!

 

management
monitoring
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Nov 22, 2011
    Hi Alscion,

     

     

    When you enable audit logging for MCP (under System | Logs | Options | MCP) and make an iControl call, the credentials passed to LTM are logged in /var/log/audit. In this example, the iControl app is logging into LTM as icontrol_user and disabling a node address:

     

     

    Nov 16 11:28:41 local/ve1 notice httpd[14618]: 01070417:0: AUDIT - user icontrol_user - RAW: httpd(mod_auth_pam): user=icontrol_user(icontrol_user) partition=[All] level=Administrator tty=/bin/false host=192.168.1.177 attempts=1 tart="Wed Nov 16 11:06:39 2011" end="Wed Nov 16 11:28:41 2011".

     

     

    Nov 16 11:30:23 local/ve1 notice mcpd[3840]: 01070417:5: AUDIT - user icontrol_user - transaction 1544928-3 - object 0 - modify { node_address { node_address_addr 10.1.0.100 node_address_monitor_state 3 } } [Status=Command OK]

     

     

    Aaron