Forum Discussion

neeraj2901_2661's avatar
neeraj2901_2661
Icon for Nimbostratus rankNimbostratus
Apr 12, 2018

who changed client ssl on ltm

I saw that someone changed the client ssl on one virtual server on ltm. How can we see that who changed it. I need logs to find out who did it but not sure how to see.

 

application delivery
BIG-IP
LTM
security
  • Nut_Pornsopon_1's avatar
    Nut_Pornsopon_1
    Icon for Nimbostratus rankNimbostratus
    Apr 12, 2018

    Navigate to System > Logs > Audit.

     

    You might be found relate user that change configuration.

     

  • neeraj2901_2661's avatar
    neeraj2901_2661
    Icon for Nimbostratus rankNimbostratus
    Apr 12, 2018

    Thank you very much. I could see the date and time when it was changed. Could you please help me with one thing? How to see the IP associated with the ID who changed it?

     

    example ...i could see userA changed it but it dont show IP

     

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for Noctilucent rankNoctilucent
    Apr 12, 2018

    Hi Neeraj,

    You can try the below,

    cat /var/log/secure | grep userA

    The output would be somewhat like this,

    user=userA host=x.x.x.x attempts=1 start="

    In case your logs have been rotated, you would find the files in .gz extn. For viewing the extension files use the zcat command,

    zcat /var/log/secure.1.gz | grep userA

    or wildcard,

    zcat /var/log/secure.* | grep userA