TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Log Management >> Authentication Logs

Authentication Logs

Use authentication logs to record device user login successes and failures. An authentication failure log also provides the reason for the failure. Authentication logs can be exported to a file for audit.

Features

• Query Authentication Logs
  
  Perform this task to query authentication logs by predefined criteria.

  Procedure

  1. Click the User tab, and then select Device User > Log Management > Authentication Logs from the navigation tree.
  2. The Query Authentication Logs function provides the basic query and advanced query. You can switch between basic query and advanced query by clicking the Basic Query link and the Advanced Query link in the right upper corner. The basic query criteria include account name, authentication result, and authentication time. The advanced query criteria include account name, authentication result, authentication time, device user group, user status, device IP, user IP, privilege level, session ID, action, authentication type, and service type. Account name supports fuzzy query.
  3. Click Query to display the authentication logs matching the query criteria or click Reset to query authentication logs with the default query criteria.
• Export Authentication Logs
  
  Perform this task to export all audit logs displayed on the authentication log list.

  Procedure

  1. Click the User tab, and then select Device User > Log Management > Authentication Logs from the navigation tree.
  2. Set the basic or advanced query criteria and click Query.
  3. Click Export.
  4. Select the file format and column separator, and click OK. The result page displays the log export result and provides a link for downloading the file.

Parameters

• Login Name: The full name a user entered for identity authentication when logging into the device. If the account name reading rules are defined in the System Parameters configuration, the system will read the login name according to the specified rules to generate the matching account name. The account name reading rules include Account name excluded the last separator and the previous contents and Account name excluded the first separator and the subsequent contents.
• Account Name: Account name of the device user. If a user does not exist, the account name is null.
• Action: Action that corresponds to the authentication. TAM only supports Login Authentication, so this field always displays Login Authentication.
• Authentication Type: Type of authentication performed for the device user: ASCII, PAP or CHAP. This parameter is configured on the device. Most devices only support ASCII.
• Service Type: Type of service provided in the authentication. Options are:
  • Login: The user is authenticated for device login.
  • Super/Enable: The user is authenticated for increasing user privilege level.
  • None: The user is authenticated for other purposes. TAM does not support this option.
• Session ID: For one login action, the device and the server use the same session ID for packet exchanges.

Remarks

• Operations to other pages can be performed during the exporting process. After the export is finished, click the Last Export Result link to view the export result.
• Export formats include text file and CSV table. When exporting logs to a text file, be sure to select the column separator. The separators include: blank space; tab; comma(,); semicolon (;); number sign (#); and dollar sign ($). The CSV format uses commas(,) as the field separators. The Windows is Excel for opening CSV files. Excel automatically selects the display format according to the contents. For example, 123456789123456789 will be displayed as 1.23457E+17 (scientific notation). In this case, display the data in the text format or use a text edit tool such as Notebook to display the data.
• When Send Syslog Messages is Yes in confguration User > Device User Policy > Service Parameters > System Configuration, TAM will send authentication log data packets to destination which Syslog Server IP and Syslog Server Port. The parameters in data packets are:
   
  1. userName: Account Name.
  2. terminal: Terminal.
  3. terminalIp: User IP Address.
  4. deviceIp: Device IP Address
  5. result: Authentication Result. 1: Succeeded; 2: Failed.
  6. errorCode: Error Code.
  7. errorDesc: Error Code Description.
  8. authTime: Authentication Time.