cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

2085
Views
0
Helpful
1
Replies
Highlighted
Beginner

Fabric Interconnect Event Logs

Where can I view the source IP of a user who attempts to log into a UCS Fabric Interconnect via ssh?  Can I view this in UCS Manager?

Everyone's tags (1)
1 REPLY 1
Cisco Employee

Re: Fabric Interconnect Event Logs

Hi,

If the login attempt to FI via ssh is successful, the details can be viewed in UCS Manager  under Admin -> Faults, Events and Audit Log -> Audit Logs

The description of the log would look like this

Fabric A: local user <username> logged in from Fabric A: local user admin logged in from <Source IP>

This information can also be viewed in syslogs if audit event logs are enabled. The syslog would look like this

<Timestamp>: %UCSM-6-AUDIT: [session][internal][creation][] Fabric A: remote user <username> logged in from <Source IP>

The failed login attempts can be viewed only in the syslogs and they would look like this

  1. Failed login attempt to FI using ssh:

     <Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - sshd[15735]

  1. Failed login attempt to UCSM Web:

      <Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - httpd[28744]

Regards

Vikramarjuna M

CreatePlease to create content
Content for Community-Ad
August's Community Spotlight Awards