Forum Discussion

Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Jul 04, 2015

Logged in user history and Commands

Hi Everyone,

 

I would like to know few things from experts here.... is there a way to know from the F5 unit it self the log telling the last 10 users who have successfully logged into the command line and the commands executed by the users. If not possible from the box what is the other best way to trace this??

 

Regards,

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
design
LTM
management
security
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 04, 2015

    At a bare minimum, this information is written to /var/log/audit if MCP and tmsh Audit Logging is enabled.

    AUDIT - user bob - RAW: sshd(pam_audit): user=bob(bob) partition=[All] level=Administrator tty=ssh host=192.168.1.1 attempts=1 start="Sat Jul  4 08:10:16 2015" end="Sat Jul  4 08:10:42 2015".

    This tells you who (bob), when it started (Sat Jul 4 08:10:16 2015), when it ended (Sat Jul 4 08:10:42 2015), and how the system was accessed (sshd(pam_audit)). A web GUI user logon would show "httpd(mod_auth_pam)". And as long as console users are only given TMSH access, that information is also recorded.

  • Techgeeeg_28888's avatar
    Techgeeeg_28888
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2015

    Hi Kevin,

     

    Thanks for the reply how to get the above out put plus the host=x.x.x.x does it show the IP address of the machine from which the F5 was accessed/???

     

  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2015

    Hi Kevin,

     

    Thanks for the reply how to get the above out put plus the host=x.x.x.x does it show the IP address of the machine from which the F5 was accessed/???