Auditing Successful User Logons

To view the details of a chosen user’s sessions with the eG Enterprise system, use the logon reports. This report enables administrators to determine which user(s) was actively using the eG Enterprise system during periods when the target environment was experiencing performance issues or exhibiting a strange behavior. Unauthorized accesses and rogue users can thus be identified quickly.

Moreover, these reports embed a special drill-down feature, which allows you a quick look at the actions performed by a particular user during the period of his/her access. This sheds light on changes effected by the user, which could have caused problems.

  1. Login to the eG administrative interface as admin.
  2. Pick the Successful Logons option from the Audits tile.
  3. Figure 1 then appears, providing a wide range of options for report generation.

    Figure 1 : Options for generating Successful User Logon reports

  4. The default Timeline for the report is 24 hours. You can choose any other fixed period from the Timeline list, or select the Any option from this list (see Figure 2). Choosing the Any timeline, allows you to provide a From and To date and time for report generation. If you change the Timeline settings, then make sure that you click the right-arrow button at its end, to register the changes. 

    Figure 2 : Choosing the Any timeline

  5. Next, select the User whose accesses you want to audit. By default, the All option is displayed here, indicating that the report provides the details of the sessions of all users to the eG Enterprise system. However, if only one user has successfully logged into the eG Enterprise system till date, then, by default, that user’s name is displayed in the User list.
  6. Administrators can configure the target environment for monitoring by directly logging into the eG administrative interface or by using the admin command line interface provided by the eG manager. This is why, by default, the audit log not only captures user logins via the web-based eG management console, but also those logins that are performed via the eG Admin Command Line Interface. While generating audit log reports, you have the option of viewing the details of successful logins across both these interfaces, or only those that pertain to a particular interface. To indicate your choice, use the Interface drop-down list. The options available in the Interface list are as follows:

    • Web: Select this option to view the details of successful logins via the web-based eG management console;
    • Command Line: Select this option to view the details of successful logins via the admin command line interface;
    • All: Select this option to view the details of all successful logins, regardless of interface used.

    If required, you can choose not to maintain audit logs for activities performed via the admin command line interface by setting the Include activities from the admin command line interface flag in the auditlog section of the manager settings page to No. In this case therefore, the Interface drop-down list will not appear.

  7. Finally, click the Show button to generate the report.

    Figure 3 : Report displaying the details of successful user logons

  8. The resulting report provides details of every successful login made by the chosen user(s). These details include (see Figure 3):

    • the name of the user
    • the IP address of the host from which the user accessed the eG management console
    • the exact time of login
    • the accurate time of logout
    • the duration of the user access
  9. If the report runs across pages, then the hyperlinked page numbers and the First, Next, Prev, and Last links at the bottom of the page will aid navigation.
  10. You can print the report by clicking on the Print icon at the right, top corner of Figure 3, or save the report as a PDF file by clicking on the Save icon. You can even save the report as a CSV file by clicking on the csv icon in Figure 3.
  11. Clicking on a user name in Figure 3 leads you to Figure 4, which reveals what configuration changes were made by that user during the period of his/her access.

    Figure 4 : Details of changes made by a user