Syslogging login and logout user access to the router

[ricky72]

Hi

I'm sending login access message to my syslog server as per the following config:

host 10.0.7.1 {
    authorization info;
    source-address 10.0.1.6;

The problem is that I get only user login and no logout message.

Any idea to solve ?

Tks

Ric

[aarseniev]

Hello,

You need to add "interactive-commands info" to get these messages.

I would recommend a separate log file as below:

aarseniev@dale> show configuration system syslog   
file login-logout {
    interactive-commands info;
    match "UI_LOG[IO]";
    explicit-priority;
}
time-format year;

 The file "login-logout" will only have  login and logout records, nothing more

aarseniev@dale> show log login-logout 
Aug 2 19:57:47 dale clear-log[15144]: logfile cleared
Aug  2 19:57:48 2012  dale mgd[15143]: %INTERACT-6-UI_LOGOUT_EVENT: User 'aarseniev' logout
Aug  2 19:57:51 2012  dale mgd[15150]: %INTERACT-6-UI_LOGIN_EVENT: User 'aarseniev' login, class 'j-super-user' [15150], ssh-connection '', client-mode 'cli'
Aug  2 19:57:51 2012  dale mgd[15150]: %INTERACT-6-UI_LOGOUT_EVENT: User 'aarseniev' logout
Aug  2 19:57:54 2012  dale mgd[15154]: %INTERACT-6-UI_LOGIN_EVENT: User 'aarseniev' login, class 'j-super-user' [15154], ssh-connection '', client-mode 'cli'

 HTH

Rgds

Alex

[ricky72]

Helps a lot.

Tks