For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

fkuser_104673's avatar
fkuser_104673
Icon for Nimbostratus rankNimbostratus
Nov 20, 2009

Logging succesfull web UI loggin attemps

Hi,

 

 

It's possible to log the correct access to the web UI. I've checked the /var/log/secure but only ssh success logins are recorded.

 

 

Changing the database value Log.Auth.Level to debug intead of error, but it not appears to have any effect. Do I need to restart any process?

 

 

Thanks!
config
design

3 Replies

  • fkuser_104673's avatar
    fkuser_104673
    Icon for Nimbostratus rankNimbostratus
    Nov 27, 2009
    I think it was not possible, as SOL said:

     

     

    In BIG-IP versions 9.4.2 through 9.6.1, only command line transactions are logged, and all messages are logged to the /var/log/secure file.

     

     

    I seems like successfull Configuration Utility authentications aer not logged

     

     

    Thanks again
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Nov 27, 2009
    I think you're correct that in pre-v10 there isn't a supported method for logging GUI login attempts or successes.

     

     

    Though, you can kind of infer successful logins by checking the /var/log/httpd/ssl_access_log for entries like this:

     

     

    Nov 27 09:23:38 ltm_hostname logger: [ssl_acc] 172.31.42.24 - my_user_name [27/Nov/2009:09:23:38 +0000] "GET /tmui/tmui/system/settings/redirect.jsp HTTP/1.1" 302 -

     

     

    This would only work for identifying logins where the user accesses the root document and is redirected to /tmui/tmui/system/settings/redirect.jsp.

     

     

    Aaron