Logging Failed Log Ons and Others...

scottie88 — Fri, 20 Jan 2017 18:55:58 GMT

Hello my fellow storage type peoples,

Security guy asked about logging failed logons to the array. I know that whenever Root logs on the array will toss an email and let you know the account has logged in, but is there a way for the array to send an email alert for failed and maybe even any log in?

Scottie

Re: Logging Failed Log Ons and Others...

mblumberg16 — Tue, 24 Jan 2017 10:24:09 GMT

Hi Scottie,

The following command will give you the information you need:

Nimble OS $ auditlog --list | grep "Login attempt"

1386577 Jan 24 2017 10:13:51 admin Succeeded Login attempt

1386579 Jan 24 2017 10:15:29 Moshe Succeeded Login attempt

1386580 Jan 24 2017 10:19:40 Moshe Failed Login attempt

Note that the output will be longer, I just selected what we needed for this example.

The user preforming the operation is just next to the time.

Now, the audit log does not generate email alerts or Infosight cases, but can be used with a syslog application.

One syslog message is generated for each alert and audit log message. Alert severity types include INFO, WARN and ERROR.

You can read more about syslog here: Nimble Storage InfoSight

Please feel free to let me know if you have any questions at all.

Thanks,

Moshe.

topic Logging Failed Log Ons and Others... in Array Setup and Networking

Logging Failed Log Ons and Others...

Re: Logging Failed Log Ons and Others...