topic Re: Audit Log in Hyperscale Firewall (Maestro)

Audit Log

Huseyin_Rencber — Sun, 17 Jun 2018 19:47:31 GMT

On the 13500 appliance I can find user command history, some changed configurations etc in /var/log/messages. As far as I know Audit Logs for Gaia Clish commands are written by the clishd and xpand daemons with local0 priority to the /var/log/messages file. For instance>

On the 41K chassis ( R76SP.50 version ) there is commands for audit log such as >

But after running these commands I could not find logs like "cmd by xxx start executing" in audit files and in var/log/messages. Where can I look for audit log, is there a way to find user clish history on 41K appliance?

Thanks.

Re: Audit Log

Sancar_Capi — Mon, 18 Jun 2018 10:27:58 GMT

Did you try asg_auditlog command?

Re: Audit Log

Huseyin_Rencber — Mon, 18 Jun 2018 11:11:47 GMT

You can not use this command in R76SP.50>

Re: Audit Log

Alexander_Wilke — Fri, 10 Aug 2018 11:02:25 GMT

In one of the latest JHFA this feature is available now for scalable plattforms. This was a neccessary feature for our deployment so we raised a RfE and luckily it found its way into the JHFA.