topic Re: NetApp Root Account Login History in ONTAP Discussions

NetApp Root Account Login History

Millsy64 — Wed, 22 Jul 2015 18:24:17 GMT

Hi All,

Is there a command I can input into my 7-mode filer's CLI to interrogate / display the root account login history, when the root username & password have been used to to access the filer's CLI.

Apparrently, the filer root account has never been used to access the filer since initial config.

I'd appreciate any suggestions

Tks In Advamce

C.J.

Re: NetApp Root Account Login History

YIshikawa — Wed, 22 Jul 2015 23:21:09 GMT

Check /etc/log/auditlog. Any CLI session and commands issued is logged here.

Re: NetApp Root Account Login History

Millsy64 — Thu, 23 Jul 2015 14:56:21 GMT

Hi Yishikawa,

Thanks very much for the /etc/log/auditlog tip.

I ran the above command you suggested on the NetApp site and found the following NetApp library link entitled "Understanding Audit Logging"

https://library.netapp.com/ecmdocs/ECMP1368862/html/GUID-B6117506-C89B-4463-A2DF-29BFAC99A72F.html

In the above link, it is suggested that the filer saves audit-log files for six weeks, (unless any audit-log file reaches the maximum size) after which the oldest audit-log file is discarded.

I suspect any of the root account logon attempts I wanted to track will already have been deleted.

I don't suppose there's any system shell commands that could accomplish the same aim?

Thanks for your response

C.J.(aka Millsy64)

Re: NetApp Root Account Login History

richard_payne — Thu, 23 Jul 2015 19:45:38 GMT

If you want to save the audit logs for longer than the filer saves them, you can always setup a syslog server and have the filer forward the messages. If you have multiple filers you can forward all their logs to that one central sysog server and have one place to search. You can also save the logs for as long as you like.

--rdp

Re: NetApp Root Account Login History

YIshikawa — Fri, 24 Jul 2015 01:09:14 GMT

Unfortunately, no other commands & logs.
As you referred, auditlog is recycled so you need to keep it on remote hosts before it is recycled.Consider to copy auditlog* to remote host via NFS or CIFS. Or,as Millsy64 wrote, consider to use syslog, some relevant KB articles are published.
https://kb.netapp.com/support/index?page=content&id=3012288
https://kb.netapp.com/support/index?page=content&id=1010374

Re: NetApp Root Account Login History

JGPSHNTAP — Fri, 24 Jul 2015 21:48:26 GMT

One suggestion would be to keep 52 weeklys on your vol0 vol...

Re: NetApp Root Account Login History

PIYUSHBANSAL198722 — Fri, 14 Aug 2015 09:53:24 GMT

Hello Dear,

Try checking in the autosupports sent to Netapp

You could also check in myautosupport not sure their retention but worth giving it a try

Thanks,

Piyush

Re: NetApp Root Account Login History

richard_payne — Fri, 14 Aug 2015 14:36:17 GMT

That works, though it does make you dependant on NetApp for storing your data. Which is fine all the time you have an active support contract.

--rdp

Re: NetApp Root Account Login History

Bala0420 — Thu, 08 Mar 2018 07:03:39 GMT

Hello team.

As i requested to you!

I jest wanted know the root user loging history can you please assist on it

Thanks,

sake