[Spacewalk-list] Access log for Satellite Administrator?

[Wilkinson, Matthew]

Thanks Nikos I will grep around and see what I can find. 

thanks again!

--Matthew Wilkinson

-----Original Message-----
From: spacewalk-list-bounces at redhat.com [mailto:spacewalk-list-bounces at redhat.com] On Behalf Of Nikos Zaharioudakis
Sent: Thursday, May 31, 2018 15:43
To: spacewalk-list at redhat.com
Subject: Re: [Spacewalk-list] Access log for Satellite Administrator?

[This is an external email. Be cautious with links, attachments and responses.]

**********************************************************************
Hi Matthew,

If you know the admin username and you got a great history of your
/var/log/messages* you can grep at least like this

[root at spacewalk-host ~]# grep scv /var/log/messages*
May 31 14:52:37 spacewalk-host server: 2018-05-31 14:52:37,632
[ajp-bio-127.0.0.1-8009-exec-15] INFO
com.redhat.rhn.frontend.action.LoginAction - LOCAL AUTH SUCCESS: [sdv]
May 31 14:53:26 spacewalk-host server: 2018-05-31 14:53:26,344
[ajp-bio-127.0.0.1-8009-exec-12] INFO
com.redhat.rhn.frontend.action.LoginAction - LOCAL AUTH FAILURE:
[sdv_admin]

there are other places you may have some info as well
/var/log/cobbler/cobbler.log:Thu May 31 15:20:37 2018 - DEBUG | REMOTE
sdv authorization result: True; user(?)

/var/log/rhn/rhn_web_api.log:[2018-05-23 11:48:47,148] INFO  -
REQUESTED FROM: https://urldefense.proofpoint.com/v2/url?u=http-3A__10.13.10.25&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=eFYo7pkLsIH3BHF6OZgkK2Wzz1JbhL0-dNtH9Ooje_A&e= CALL: auth.checkAuthToken(sdv,
62f5726a6b716f309985f294fdf86x3e221d7f82e1645a7e5e8f82cfa1d2fb)
CALLER: (none) TIME: 0.0 seconds


There might be other ways if this info is kept in the database as
well, but I am not aware
Nikos

########################################3
Zaharioudakis Nikos, RHC{A,DS,E,VA,X,I}, VCP(4,5},VCI, Mentor VCI,
Zimbra Instructor
https://www.redhat.com/rhtapps/verify/?certId=100-001-262
Public  Calendar :
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_calendar_embed-3Fsrc-3Dnzahar-2540gmail.com-26ctz-3DEurope_Athens&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=u4wKN6n6wyXiPBZ4eKuu_c8jbygfFmZ3uptqtZldMwE&e=
+30 694 720 40 63
https://urldefense.proofpoint.com/v2/url?u=http-3A__zimbra.wikidot.com_zimbra-2Dinstallations-2Din-2Dgreece&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=zAiZSUEdOQBVhlQd3DBKJTtN5NVxp46be5Jy7c9ngm0&e=


On 31 May 2018 at 23:25, Wilkinson, Matthew
<MatthewWilkinson at alliantenergy.com> wrote:
> Is there any way to generate a report to see if the default Satellite Administrator account has been accessed since Spacewalk was initially configured?
>
> Thanks!
>
> Matthew Wilkinson | Lead Server Administrator, Unix
>
> _______________________________________________
> Spacewalk-list mailing list
> Spacewalk-list at redhat.com
> https://www.redhat.com/mailman/listinfo/spacewalk-list

_______________________________________________
Spacewalk-list mailing list
Spacewalk-list at redhat.com
https://www.redhat.com/mailman/listinfo/spacewalk-list