Overview of the netLD audit log.


This document describes netLD's authentication audit logging feature.


Overview

NetLD provides a log file for seeing when users log in and out of the netLD interface.


This feature was added in netLD version 16.


File location

Windows

C:\Program Files\Net LineDancer\audit.log


Linux

/usr/share/netld/log/audit.log


File Contents

Each line in the audit.log file represents a single audit event containing the timestamp of when the event occurred, the category* of the event, and a message describing the event


*Currently only the AUTH category is supported.


Message Types

The following message types are currently available

 Type  Description  Example
Login A user logged in successfully Web login for user admin from 10.211.55.11
Logout A user logged out Web logout for user admin from 10.211.55.11
Login Failure An authentication was attempted but failed Web login failed for user test from 10.211.55.11

The authentication events will be for either "Web" for a web client login or for "SSH" for Terminal Proxy login. 


Example Contents

16-04-20 18:42:15,470 [AUTH      ] Web login for user admin from 0:0:0:0:0:0:0:1
16-04-20 19:42:31,575 [AUTH      ] Web logout for user admin from 0:0:0:0:0:0:0:1
16-04-21 18:40:13,539 [AUTH      ] Web login for user admin from 10.211.55.11
16-04-21 18:40:31,643 [AUTH      ] Web logout for user admin from 10.211.55.11
16-04-21 18:40:40,844 [AUTH      ] Web login for user test from 10.211.55.11
16-04-21 18:40:46,987 [AUTH      ] Web logout for user test from 10.211.55.11
16-04-21 18:41:39,510 [AUTH      ] SSH login for user admin from 10.211.55.11
16-04-21 18:41:48,505 [AUTH      ] SSH logout for user admin from 10.211.55.11
16-04-21 18:43:04,453 [AUTH      ] Web login failed for user test from 10.211.55.11