NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

xlnddel's avatar
xlnddel
Aspirant
Mar 14, 2017

GSM7352S - Login Audit

Model:  GSM7352Sv2 48-Port Gigabit Layer 3 Stackable Managed Switch with 2 10G SFP+ Firmware Version: 10.0.0.44 Boot Version: 01.00.35   Hi All,    I am looking for some assistance in regards t...
Installation
Solutions
DanielZhang's avatar
DanielZhang
NETGEAR Expert
Mar 15, 2017

Hi Damien,

 

Welcome to NETGEAR community！:smileyhappy:

 

Please set the Severity Filter to "informational" level of Syslog server.

So you can see the syslog contains login authentication status.

 

Please find more information form following screenshot.

config.png

syslog.png

xlnddel's avatar
xlnddel
Aspirant
Mar 15, 2017

Hi Daniel, 

 

Thanks alot for your response, I have set the Severity Filter to "informational" which is now showing the following events: 

|14| MAR 15 09:11:26 192.168.100.100-1 General[131842608]: main_login.c(214) 10450 %% HTTPS Session 11 initiated for user admin connected from 10.81.0.140..


|14| MAR 15 09:18:33 192.168.100.100-1 CLI_WEB[131842608]: emweb_common_custom.c(120) 10459 %% HTTPS Session 11 ended for user admin connected from 10.81.0.140..

 

Which is great, however it does not appear to show SSH session or anything of the sort, is there anything extra that is required for SSH/Telnet login Attempts?

 

Thanks

Damien. 

 

  • DanielZhang's avatar
    DanielZhang
    NETGEAR Expert
    Mar 16, 2017

    Hi Damien,

     

    That's a good idea to add a access type for login session of Syslog.

    I have report a feature request about this.:smileyhappy:

     

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More