ESA REMOTE HOST 127.0.0.1

[Fredy caceres cabrera]

Hi, anyone know why the appliance use admin username and remote host 127.0.0.1? 

I took this output from who command when CPU hiigh.

Regards. 

[ppreenja]

Hello Fredy,

It can be due to some system service logging into the unit to perform a job such as logging in to generate a scheduled report.

You can try and check on the same.

I hope the above answers your query.

Cheers,
Pratham

[anjalik]

Hi Fredy,

When you run the who command, it will show the recent user who logged into the device and the Remote host usually shows the host IP from which the user is logged in. It could be your computer/machine IP, but this loop back indicates 

that it is establishing an IP connection to the same machine or computer being used by the end-user.

If you see the GUI logs on the device you may find these details there as well:

Tue May 26 xx:xx:xx 2020 Info: req:x.x.x.x user:admin id:Ti@@9uJTjki1237Mz0WNnz 200 GET /system_administration/tech_support/remote_access?action=RetrieveTunnelStatus&CSRFKey=1234ac12e-1111-d111-11c1-e31716af12ca HTTP/1.1 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

Where in x.x.x.x is the remote host IP of the admin.

Regards,

Anjali

[Fredy caceres cabrera]

@anjalik That GUI logs, can see on system logs or status logs onto System Administration > Log Subscriptions ?