topic Re: Can I see the user-id syslog agent's log? in General Topics

Can I see the user-id syslog agent's log?

djr — Mon, 07 Apr 2014 17:09:41 GMT

I am using agentless syslog integration for user ID and it's working but for every login event I am seeing twice as many log messages received as auth success log messages and I want to know why. Is there a way to look at the logs received by the PA?

>show user server-monitor state exi

UDP Syslog Listener Service is enabled

SSL Syslog Listener Service is disabled

Proxy: exi(vsys: vsys1) Host: exi(1.2.3.4)

number of log messages : 16

number of auth. success messages : 8

Re: Can I see the user-id syslog agent's log?

jdelio — Mon, 07 Apr 2014 20:21:45 GMT

If you would like to read the Firewalls User-ID logs, you can view the contents while logged into the Firewall in question and enter the following:

>less mp-log useridd.log

Using the Less command allows you to view like Vi, mp-log is the Management plane logs, and finally the useridd.log is the User-ID Daemon log file.

I hope this answers your question.

Re: Can I see the user-id syslog agent's log?

djr — Tue, 08 Apr 2014 08:30:09 GMT

Hi, thanks I had tried that butthe useridd log doesn't show the incoming syslogs.