Hi,
If the login attempt to FI via ssh is successful, the details can be viewed in UCS Manager under Admin -> Faults, Events and Audit Log -> Audit Logs
The description of the log would look like this
Fabric A: local user <username> logged in from Fabric A: local user admin logged in from <Source IP>
This information can also be viewed in syslogs if audit event logs are enabled. The syslog would look like this
<Timestamp>: %UCSM-6-AUDIT: [session][internal][creation][] Fabric A: remote user <username> logged in from <Source IP>
The failed login attempts can be viewed only in the syslogs and they would look like this
- Failed login attempt to FI using ssh:
<Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - sshd[15735]
- Failed login attempt to UCSM Web:
<Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - httpd[28744]
Regards
Vikramarjuna M