For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

neeraj2901_2661's avatar
neeraj2901_2661
Icon for Nimbostratus rankNimbostratus
Apr 12, 2018

who changed client ssl on ltm

I saw that someone changed the client ssl on one virtual server on ltm. How can we see that who changed it. I need logs to find out who did it but not sure how to see.  
application delivery
BIG-IP
LTM
security
jaikumar_f5's avatar
jaikumar_f5
Icon for Noctilucent rankNoctilucent
Apr 12, 2018

Hi Neeraj,

You can try the below,

cat /var/log/secure | grep userA

The output would be somewhat like this,

user=userA host=x.x.x.x attempts=1 start="

In case your logs have been rotated, you would find the files in .gz extn. For viewing the extension files use the zcat command,

zcat /var/log/secure.1.gz | grep userA

or wildcard,

zcat /var/log/secure.* | grep userA