Logging Failed Log Ons and Others...

[scottie88]

Hello my fellow storage type peoples,

Security guy asked about logging failed logons to the array. I know that whenever Root logs on the array will toss an email and let you know the account has logged in, but is there a way for the array to send an email alert for failed and maybe even any log in?

Scottie

[mblumberg16 · Accepted solution]

Hi Scottie,

The following command will give you the information you need:

Nimble OS $ auditlog  --list | grep "Login attempt"

1386577 Jan 24 2017 10:13:51 admin           Succeeded Login attempt

1386579 Jan 24 2017 10:15:29 Moshe           Succeeded Login attempt

1386580 Jan 24 2017 10:19:40 Moshe           Failed    Login attempt

Note that the output will be longer, I just selected what we needed for this example.

The user preforming the operation is just next to the time.

Now, the audit log does not generate email alerts or Infosight cases, but can be used with a syslog application.

One syslog message is generated for each alert and audit log message. Alert severity types include INFO, WARN and ERROR.

You can read more about syslog here: Nimble Storage InfoSight

Please feel free to let me know if you have any questions at all.

Thanks,

Moshe.