- Products
- Learn
- Local User Groups
- Partners
- More
Step Into the Future of
AI-Powered Cyber Security
When the Agents Attack
A Live Look at Agentic Exposure Validation
Bridge the CAASM Gap
with Exposure Management
AI Security Masters E8:
Claude Mythos: New Era in Cyber Security
CheckMates Go:
CheckMates Fest
Hello guys,
I dont know if someone already experienced similar behaviour but, on the Audit Logs tab am having my username constantly logging in and logging out messages (as shown below). I am using the MDS environment and I have tried to kill some related processes, but the issue is still the same.
To clarify only :
I am able normally to log in (and work) to all of my domains but when I take look at my Audit logs tab, I have every second the log entry showing log off and log on.....
Does it make some sense to any of you guys?
Thanks in advance for the help!
The only time I would expect to see logs like that is if someone’s running mgmt_cli -r true.
Do you have any scripts calling that?
As a colleague who was here before me left the company, I am not able to say that with 100% certainty.
Is there a way to determine that some scripts are still working? Some command or something?
The username is inherited from him....
Thanks!
WEB_API is the standard username used when mgmt_cli -r true is invoked.
I would review any cron jobs on the management and see what scripts are running.
I recently got a reply from a Teams thread that said-
Hello Garretth,
Could you please clarify more about what are PUV and DA?
We are having the same issue WEB_API constant login/logout. Moreover, we have another issue which is the WEB_API keep publishing a lot of revisions every 3 minutes although there is nothing change of configuration. And we are not sure if both issue is related.
Regards
Hello, could it because I have a log exporter running?
Possibly, but can't say for sure.
If you want to get to the bottom of it, a TAC case is probably in order.
Hello,
It's not an issue following this SecureKnowledge: sk179685
You can still use the query syntax "NOT administrator:WEB_API " in the search bar to hide all these messages
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 3 | |
| 3 | |
| 3 |
Wed 10 Jun 2026 @ 01:00 PM (EDT)
Deep Dive: When the Agents Attack: A Live Look at Agentic Exposure ValidationThu 11 Jun 2026 @ 11:00 AM (EDT)
Tips and Tricks 2026 #8: Say Yes to AI Without Saying Yes to RiskFri 12 Jun 2026 @ 10:00 AM (CEST)
CheckMates Live Netherlands - Sessie 47: Continuous Threat Exposure ManagementTue 16 Jun 2026 @ 05:00 PM (CEST)
Under the Hood: Check Point SASE | Internet Access Optimization & Performance TuningWed 10 Jun 2026 @ 01:00 PM (EDT)
Deep Dive: When the Agents Attack: A Live Look at Agentic Exposure ValidationThu 11 Jun 2026 @ 11:00 AM (EDT)
Tips and Tricks 2026 #8: Say Yes to AI Without Saying Yes to RiskFri 12 Jun 2026 @ 10:00 AM (CEST)
CheckMates Live Netherlands - Sessie 47: Continuous Threat Exposure ManagementTue 16 Jun 2026 @ 05:00 PM (CEST)
Under the Hood: Check Point SASE | Internet Access Optimization & Performance TuningThu 18 Jun 2026 @ 10:00 AM (CEST)
The Cloud Architects Series: Check Point WAF - The Next Generation of AI powered protectionAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY