It appears the audit logs downloaded from the /dumps/audit directory only log users if they initiate an action. Is there another log that records user logins via cli and console regardless of any action taken?

Thanks.

------------------------------
IBM-SAN Admin
------------------------------

#StorageAreaNetworks
#Storage
#PrimaryStorage

In the SNAP under dumps/syslogs there is a file named secure.<serial>

This file has records like:

Feb  15 00:10:17 SVCDEMO sshd[32367]: Accepted password for tpcuser1 from 10.0.5.168 port 54883 ssh2
Feb  15 00:10:17 SVCDEMO sshd[32367]: pam_unix(sshd:session): session opened for user tpcuser1 by (uid=0)
Feb  15 00:10:18 SVCDEMO sshd[32370]: error: Received disconnect from 10.0.5.168 port 54883:10: General disconnection
Feb  15 00:10:18 SVCDEMO sshd[32370]: Disconnected from user tpcuser1 10.0.5.168 port 54883
Feb  15 00:10:18 SVCDEMO sshd[32367]: pam_unix(sshd:session): session closed for user tpcuser1

Not sure if all kind of cli logins are logged here.

------------------------------
T Masteen
------------------------------