F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Alscion_68122's avatar
Alscion_68122
Icon for Nimbostratus rankNimbostratus
Nov 22, 2011

iControl command in audit log

Hi,     When i enter a command in tmsh, i see it the audit log, and so in my remote syslog to. For example, when i load my conf with the command tmsh load sys config and I can see in the syslog...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Nov 22, 2011
Hi Alscion,

 

 

When you enable audit logging for MCP (under System | Logs | Options | MCP) and make an iControl call, the credentials passed to LTM are logged in /var/log/audit. In this example, the iControl app is logging into LTM as icontrol_user and disabling a node address:

 

 

Nov 16 11:28:41 local/ve1 notice httpd[14618]: 01070417:0: AUDIT - user icontrol_user - RAW: httpd(mod_auth_pam): user=icontrol_user(icontrol_user) partition=[All] level=Administrator tty=/bin/false host=192.168.1.177 attempts=1 tart="Wed Nov 16 11:06:39 2011" end="Wed Nov 16 11:28:41 2011".

 

 

Nov 16 11:30:23 local/ve1 notice mcpd[3840]: 01070417:5: AUDIT - user icontrol_user - transaction 1544928-3 - object 0 - modify { node_address { node_address_addr 10.1.0.100 node_address_monitor_state 3 } } [Status=Command OK]

 

 

Aaron