Can I see the user-id syslog agent's log?

[djr]

I am using agentless syslog integration for user ID and it's working but for every login event I am seeing twice as many log messages received as auth success log messages and I want to know why.  Is there a way to look at the logs received by the PA?

>show user server-monitor state exi

        UDP Syslog Listener Service is enabled

        SSL Syslog Listener Service is disabled

Proxy: exi(vsys: vsys1)         Host: exi(1.2.3.4)

        number of log messages                            : 16

        number of auth. success messages                  : 8

[jdelio]

If you would like to read the Firewalls User-ID logs, you can view the contents while logged into the Firewall in question and enter the following:

>less mp-log useridd.log

Using the Less command allows you to view like Vi, mp-log is the Management plane logs, and finally the useridd.log is the User-ID Daemon log file.

I hope this answers your question.

[djr]

Hi, thanks I had tried that butthe useridd log doesn't show the incoming syslogs.