Fabric Interconnect Event Logs

[notofthisearth]

Where can I view the source IP of a user who attempts to log into a UCS Fabric Interconnect via ssh?  Can I view this in UCS Manager?

[vikmalap]

Hi,

If the login attempt to FI via ssh is successful, the details can be viewed in UCS Manager  under Admin -> Faults, Events and Audit Log -> Audit Logs

The description of the log would look like this

Fabric A: local user <username> logged in from Fabric A: local user admin logged in from <Source IP>

This information can also be viewed in syslogs if audit event logs are enabled. The syslog would look like this

<Timestamp>: %UCSM-6-AUDIT: [session][internal][creation][] Fabric A: remote user <username> logged in from <Source IP>

The failed login attempts can be viewed only in the syslogs and they would look like this

1. Failed login attempt to FI using ssh:

     <Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - sshd[15735]

1. Failed login attempt to UCSM Web:

      <Timestamp>: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username> from <Source IP> - httpd[28744]

Regards

Vikramarjuna M