Technology Blog

[ArubaOS 6.3] Who is logging in and out of your controller and from where - "show audit-trail login"

Guru Elite Guru Elite
Guru Elite

The "show audit-trail" command can show you configuration commands that are typed on the commandline or on the GUI.  It can also show you who is logging in and out. Information about the command is here:  http://community.arubanetworks.com/t5/Command-of-the-Day/COTD-audit-trail-all/m-p/971/highlight/true#M65

 

One limitation of this command is that it cannot by default show ONLY who is logging in and out of your controller.  In ArubaOS 6.3 there is a "show audit-trail login" command that shows ONLY logins and logouts:

 

(192.168.1.3) #        show audit-trail login 
Sep 28 22:44:07  cli[1496]: USER: admin has logged in from 192.168.1.6. 
Sep 28 22:44:10  cli[1496]: USER: admin connected from 192.168.1.6 has logged out. 
Sep 29 07:11:47  cli[1496]: USER: admin has logged in from 192.168.1.121. 
Sep 29 07:28:35  cli[1496]: USER: admin connected from 192.168.1.121 has logged out. 
Sep 29 11:13:18  cli[1496]: USER: admin has logged in from 192.168.1.67. 
Sep 29 11:28:35  cli[1496]: USER: admin connected from 192.168.1.67 has logged out. 
Sep 29 20:22:54  cli[1496]: USER: admin has logged in from 192.168.1.79. 

 When logs are collected on the controller using "tar logs tech-support" or through the GUI, the audit trail login is saved to the file /var/log/oslog/audittrail-login_out.log"

 

 

Comments
New Member

Audit-trail-login

 

 

Done a quick replication in lab and I have a query:

 

I see two modules shown in the output:  cli[1548]  and fpcli

 

If a user SSH into controller from the controller's local subnet, then it shows as cli[1548],  and if I user SSH into controller from a different subnet, it shows as fpcli.  Is there any specific reason behind ? Both the requests are entering through the same LAN interface port. 

 

But in case of GUI login:  No matter where the user logins from (local or other subnet), it shows the same module webui[1547]

New Member

By the way the controller IP is : 10.30.156.140

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Read all about it! If it’s happening now, it’s in the community.

Check out the latest blogs from your community team, the community experts and other industry sources.
Labels