Q: How do i get a list of users who logged into Airwave box on a given day?
A: Airwave stores 4 logs for the httpd data.
Below is what one will see if he does a list directory for /var/log/httpd directory.
[root@quamruz mercury]# ls -ll /var/log/httpd
total 56
lrwxrwxrwx 1 root root 36 Nov 25 00:11 access_log -> /var/log/httpd/access_log.2015-11-25
-rw-r--r-- 1 root root 431 Nov 22 23:01 access_log.2015-11-22
-rw-r--r-- 1 root root 12788 Nov 23 23:44 access_log.2015-11-23
-rw-r--r-- 1 root root 11257 Nov 24 01:20 access_log.2015-11-24
-rw-r--r-- 1 root root 431 Nov 25 00:11 access_log.2015-11-25
lrwxrwxrwx 1 root root 35 Nov 24 00:09 error_log -> /var/log/httpd/error_log.2015-11-24
-rw-r--r-- 1 root root 558 Nov 16 01:46 error_log.2015-11-16
-rw-r--r-- 1 root root 436 Nov 19 07:39 error_log.2015-11-19
-rw-r--r-- 1 root root 1963 Nov 23 23:59 error_log.2015-11-23
-rw-r--r-- 1 root root 1836 Nov 24 00:10 error_log.2015-11-24
drwxr-xr-x 2 apache apache 4096 Jun 18 2013 profiling/
-rw-r--r-- 1 root root 0 Jun 18 2013 redirect-rewrite.log
The login information will be listed in the access_log and we can track the user login based on the dates we have logs for.
We can run the below command.
cat /var/log/httpd/access_log.<date> | awk '{print $3}' | sort |uniq
Below is a sample of the output.
[root@quamruz mercury]# cat /var/log/httpd/access_log.2015-11-24| awk '{print $3}' | sort | uniq
-
admin
test-user
aruba-lab-user
MQRwYKVxPJ
The last username "MQRwYKVxPJ" is a system generated username which is used by VisualRf to sync data.