HP Intelligent Management Center v5.1 TACACS+ Authentication Manager Administrator Guide

115
Viewing the audit log list
To view the audit log list:
1. Click the User tab.
2. Select Device User View > Log Management > Audit Logs from the navigation tree. The Audit Log
List displays all audit logs.
Audit log list contents
 Login Name—Username sent by the device to TAM, which is not the username that a device
user entered when logging in to the device. Login name of a device user contains redundant
information, and needs to be extracted. TAM matches the extracted login name against the
account name and authenticates the user. The rules for extracting the login name are
configured in system parameter configuration. For more information, see "Configuring system
parameters."
 Account Name—Account name of the device user. Accounts with the name followed by
#delete0# are cancelled accounts. Click the account name of a device user to view the user
details. For more information about device user details, see "Viewing device user details."
 CLI—Command executed by the device user.
 Audit Type—Type of the audit. Audit types include Start, Update, End, Enter Command At CLI,
Clear Online Data, and Age Online Data.
 Start indicates the log was generated when a user successfully logged in to a device. End
indicates the log was generated when a user logged off a device. Update indicates the log
was generated when TAM received a watchdog packet periodically sent by an online user to
declare that the user is still online. Enter Command At CLI indicates the log was generated
when a user executed a command at the CLI. Clear Online Data indicates the log was
generated when an operator manually cleared online user information. Age Online Data
indicates the log was generated when TAM periodically cleared aged online users according
to the Aging Time specified in the system parameter configuration.
 Audit Time—Date and time when the audit was performed, in the format of YYYY-MM-DD
hh:mm:ss.
 Device IP—IP address of the device to which the device user logs in.
 Details—Click the Details icon for an audit log to view its details.
Navigating the audit log list
 Click to page forward in the audit log list.
 Click to page forward to the end of the audit log list.
 Click to page backward in the audit log list.
 Click to page backward to the front of the audit log list.
Click 8, 15, 50, 100, or 200 on the upper right corner of the main pane to configure how many
items per page you want to view.
Querying audit logs
TAM provides basic query and advanced query for audit logs. Basic query criteria include several key
parameters for quick search. Advanced query offers various query criteria for precise match.