Gateway secure log - Can these be seen in Smart Console

[rambrose]

Hey all,

I'm sure this will have been asked before but had a search and couldn't find what I need.

If someone attempts a login to a gateway this is shown in the secure log file which is fine but is there a way to get this to be displayed in the logs of Smart Console or can it only be checked on the gateway itself?

Richard

*Edit found sk102995 think this will do what I need

[G_W_Albrecht]

I would point you to Audit Logs, available forSMS and GWs:

[rambrose]

For some reason those audit logs only show login/logout events on Smart Console not if someone logs into a gateway directly via ssh for management.

I just need to figure out if that has been disabled on our MDS/CMA's/Gateways or wasn't something enabled in the first place.

[rambrose]

If it helps anyone else, following sk102995 and enabling syslog on the gateways and SMS/MDS does now show the login logs to a gateway  in the normal log view

 

Helpfully still have access to a training course lab so was easy enough to test.

[Chillyjim]

If you are looking for the logs in /var/log/secure to see someone that logs in with a bash shell and not a clish shell, that is generated via syslog. So, you need to set the log server to accept syslog and tell the devices to send the syslogs too the log servers.
I don't have a manager set up at the moment to take screen shots for you but it is under the "Log" section toward the bottom of one of the pages. If you have SmartEvent, you can also set up alerts for logins out of normal hours.

You can always ping me and I'm happy to walk you through it, and take some screen shots.