GSM7352S - Login Audit

[xlnddel]

Model:  GSM7352Sv2 48-Port Gigabit Layer 3 Stackable Managed Switch with 2 10G SFP+

Firmware Version: 10.0.0.44
Boot Version: 01.00.35

Hi All, 

I am looking for some assistance in regards to logging login attempts on this netgear switch. 

On the cisco switches we can issue the below commands in conf t which allow us to log login attempts to syslog.

login on-failure log

login on-success log

We have setup syslogging on netgear switch however it is only providing is with CLI input and any notifcation events at trap level 5 which do not contain login events.

Does anybody have any idea how to log the information we require?

Kind Regards

Damien. 

[DanielZhang]

Hi Damien,

Welcome to NETGEAR community！

Please set the Severity Filter to "informational" level of Syslog server.

So you can see the syslog contains login authentication status.

Please find more information form following screenshot.

[xlnddel]

Hi Daniel, 

Thanks alot for your response, I have set the Severity Filter to "informational" which is now showing the following events: 

|14| MAR 15 09:11:26 192.168.100.100-1 General[131842608]: main_login.c(214) 10450 %% HTTPS Session 11 initiated for user admin connected from 10.81.0.140..

|14| MAR 15 09:18:33 192.168.100.100-1 CLI_WEB[131842608]: emweb_common_custom.c(120) 10459 %% HTTPS Session 11 ended for user admin connected from 10.81.0.140..

Which is great, however it does not appear to show SSH session or anything of the sort, is there anything extra that is required for SSH/Telnet login Attempts?

Thanks

Damien. 

[DanielZhang]

Hi Damien,

That's a good idea to add a access type for login session of Syslog.

I have report a feature request about this.