Thanks Nikos I will grep around and see what I can find. thanks again!
--Matthew Wilkinson -----Original Message----- From: spacewalk-list-boun...@redhat.com [mailto:spacewalk-list-boun...@redhat.com] On Behalf Of Nikos Zaharioudakis Sent: Thursday, May 31, 2018 15:43 To: spacewalk-list@redhat.com Subject: Re: [Spacewalk-list] Access log for Satellite Administrator? [This is an external email. Be cautious with links, attachments and responses.] ********************************************************************** Hi Matthew, If you know the admin username and you got a great history of your /var/log/messages* you can grep at least like this [root@spacewalk-host ~]# grep scv /var/log/messages* May 31 14:52:37 spacewalk-host server: 2018-05-31 14:52:37,632 [ajp-bio-127.0.0.1-8009-exec-15] INFO com.redhat.rhn.frontend.action.LoginAction - LOCAL AUTH SUCCESS: [sdv] May 31 14:53:26 spacewalk-host server: 2018-05-31 14:53:26,344 [ajp-bio-127.0.0.1-8009-exec-12] INFO com.redhat.rhn.frontend.action.LoginAction - LOCAL AUTH FAILURE: [sdv_admin] there are other places you may have some info as well /var/log/cobbler/cobbler.log:Thu May 31 15:20:37 2018 - DEBUG | REMOTE sdv authorization result: True; user(?) /var/log/rhn/rhn_web_api.log:[2018-05-23 11:48:47,148] INFO - REQUESTED FROM: https://urldefense.proofpoint.com/v2/url?u=http-3A__10.13.10.25&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=eFYo7pkLsIH3BHF6OZgkK2Wzz1JbhL0-dNtH9Ooje_A&e= CALL: auth.checkAuthToken(sdv, 62f5726a6b716f309985f294fdf86x3e221d7f82e1645a7e5e8f82cfa1d2fb) CALLER: (none) TIME: 0.0 seconds There might be other ways if this info is kept in the database as well, but I am not aware Nikos ########################################3 Zaharioudakis Nikos, RHC{A,DS,E,VA,X,I}, VCP(4,5},VCI, Mentor VCI, Zimbra Instructor https://www.redhat.com/rhtapps/verify/?certId=100-001-262 Public Calendar : https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_calendar_embed-3Fsrc-3Dnzahar-2540gmail.com-26ctz-3DEurope_Athens&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=u4wKN6n6wyXiPBZ4eKuu_c8jbygfFmZ3uptqtZldMwE&e= +30 694 720 40 63 https://urldefense.proofpoint.com/v2/url?u=http-3A__zimbra.wikidot.com_zimbra-2Dinstallations-2Din-2Dgreece&d=DwICAg&c=GUDVeAVg1gjs_GJkmwL1m3gEzDND7NeJG5BIAX_2yRE&r=zxSMv3Yyn0u8GiLjBm805qsHQ-PQnlWklaJFaNwJsRdou0Rx32Ld6bt57-Tq1kdA&m=n2k5XbgCCk6iqGz0Y0ZiX5cuOtxL5HenaNNBQMRCLSw&s=zAiZSUEdOQBVhlQd3DBKJTtN5NVxp46be5Jy7c9ngm0&e= On 31 May 2018 at 23:25, Wilkinson, Matthew <matthewwilkin...@alliantenergy.com> wrote: > Is there any way to generate a report to see if the default Satellite > Administrator account has been accessed since Spacewalk was initially > configured? > > Thanks! > > Matthew Wilkinson | Lead Server Administrator, Unix > > _______________________________________________ > Spacewalk-list mailing list > Spacewalk-list@redhat.com > https://www.redhat.com/mailman/listinfo/spacewalk-list _______________________________________________ Spacewalk-list mailing list Spacewalk-list@redhat.com https://www.redhat.com/mailman/listinfo/spacewalk-list _______________________________________________ Spacewalk-list mailing list Spacewalk-list@redhat.com https://www.redhat.com/mailman/listinfo/spacewalk-list
