Which log file should a BIG-IP Administrator review to determine whether a specific user attempted to log in to the BIG-IP Configuration Utility?
The BIG-IP Configuration Utility runs on Apache (httpd) and uses PAM for authentication. PAM logs all authentication attempts — including GUI login attempts — to /var/log/secure, recording the username, timestamp, and whether the attempt succeeded or failed. This makes /var/log/secure the appropriate log to check to confirm whether a specific user tried to log in to the Configuration Utility.
Community Discussion