Forum Discussion

Alscion_68122's avatar
Icon for Nimbostratus rankNimbostratus
Nov 22, 2011

iControl command in audit log




When i enter a command in tmsh, i see it the audit log, and so in my remote syslog to. For example, when i load my conf with the command tmsh load sys config and I can see in the syslog the corresponding log: module=(tmos) status=[Command OK] cmd_data=load sys config



How can I have the same type of log with a command asked by iControl? I want the command passed with a remote server using iControl is logged in audit as the same. Does anybody has an idea?





2 Replies

  • Hi Alscion,



    When you enable audit logging for MCP (under System | Logs | Options | MCP) and make an iControl call, the credentials passed to LTM are logged in /var/log/audit. In this example, the iControl app is logging into LTM as icontrol_user and disabling a node address:



    Nov 16 11:28:41 local/ve1 notice httpd[14618]: 01070417:0: AUDIT - user icontrol_user - RAW: httpd(mod_auth_pam): user=icontrol_user(icontrol_user) partition=[All] level=Administrator tty=/bin/false host= attempts=1 tart="Wed Nov 16 11:06:39 2011" end="Wed Nov 16 11:28:41 2011".



    Nov 16 11:30:23 local/ve1 notice mcpd[3840]: 01070417:5: AUDIT - user icontrol_user - transaction 1544928-3 - object 0 - modify { node_address { node_address_addr node_address_monitor_state 3 } } [Status=Command OK]