TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Online User Management

Online User Management

An online user logs into and manages a device. On the online user list, you can view, trace, and maintain online users.

Features

• Query Online Users
  
  Perform this task to query online users by predefined query criteria.

  Procedure

  1. Click the User tab, and then select Device User > All Online Users from the navigation tree.
  2. The Query Online Users function provides the basic query and advanced query. You can switch between basic query and advanced query by clicking the Basic Query link and the Advanced Query link in the right upper corner. The basic query criteria include the account name and device user group. The advanced query criteria include the account name, device user group, authorization policy, login name, device IP, user IP, login time, and terminal. Account name, login name, and terminal support fuzzy query.
  3. Click Query to display the online users matching the query criteria or click Reset to query online users with the default query criteria.
• Clear Online Information
  
  If a user has logged off but the system still displays the user as online, the user is referred to as a halted user. The following scenarios will generate halted users: 1) The device is powered off and then restarts. All online users of the device are logged off in this case. Because the TAM server receives no logoff requests, it still displays the users as online. 2) When a user logs off, the logoff request sent from the device to the TAM server is lost. In this case, the TAM still displays the user as online.
  For halted users, the system provides two methods to clear the online records: 1) Operators manually clear the online data from the online user list. 2) The system automatically clears the online data after users are halted for a specific period of time. This period is determined by the Aging Time parameter in System Parameters configuration.
  Perform this task to clear online users manually.

  Procedure

  1. Click the User tab, and then select Device User > All Online Users from the navigation tree.
  2. Select one or more online users on the online user list, and then click Clear Online Info.
     A confirmation dialog box appears.
  3. Click OK.
• Add to Denylist
  
  When you find that an online user may bring security threatens, you can add the user to the denylist. After an online user is added to the denylist, the online status of the user does not change, but the user cannot log in to any device any more. Users blocked by operators can be un-blocked only by operators.
  Perform this task to add an online user to the denylist.

  Procedure

  1. Click the User tab, and then select Device User > All Online Users from the navigation tree.
  2. Click the Add to Denylist link in the Operation column of an online user.
• Remove from Denylist
  
  Perform this task to manually remove online users from the denylist. Users which not in denylist can log in and manage devices.

  Procedure

  1. Click the User tab, and then select Device User > All Online Users from the navigation tree.
  2. Click the Remove from Denylist icon in the Operation column of an online user.

Remarks

• When TAM automatically clears aged online data, if a device is not enabled with watchdog packet sending (see the Watchdog parameter in Device Management), TAM will not clear the users logged in to the device from the online user list.
• Make sure that a user has logged off before you manually clear the user from the online user list. If you clear a user on the online user list but the user is not logged off, the user can still manage the device and TAM will record audit logs for the user.
• The online duration can be collected when the following requirements are met:
  • The device of the online user supports watchdog packets.
  • The operator specifies support for watchdog packets when adding the device to TAM.