Solved: sending syslog message on logon

paulnigel · ‎09-20-2007

Hi forum,

How do I configure the syslog to send message when user logon to the router, either success or fail.

Thanks much,

paul

yjdabear · ‎09-20-2007

You'd need a certain version of IOS deployed. Details in this thread:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dddc4b2/0#selected_message

View solution in original post

yjdabear · ‎09-25-2007

Do you have the pre-requisite "login block-for seconds attempts tries within seconds" configured, as specified in this section? I'm not sure how "log on-success ..." worked if the above were not configured.

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b93.html#wp1027195

Also, according to this document

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/hsec_c/part30/h_login.htm

"Logging messages for failed login attempts are automatically enabled when the auto secure command is issued; they are not automatically enabled for successful login attempts via autosecure."

View solution in original post

yjdabear · ‎09-20-2007

You'd need a certain version of IOS deployed. Details in this thread:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dddc4b2/0#selected_message

paulnigel · ‎09-20-2007

Thank you very much yjdabear,

This solves my problem!

Thanks much,

PN

paulnigel · ‎09-24-2007

Hi Yjdabear,

I am able to log the success logon, but i cant log the failure logon, i use this command:

login on-failure log

login on-success log

but i only get this:

%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:

anything that I must look out for?

Thanks much,

PN

yjdabear · ‎09-24-2007

Are the failures showing up with "show login" or "show login failures"?

paulnigel · ‎09-24-2007

Hi yjdabear,

when I issue sh login failures, i get this result, actually i tried with failed attempts to test, therefore it cant be true:

sh login failures

*** No logged failed login attempts with the device.***

I am actually login to a remote syslog server.

Thanks much,

paul

yjdabear · ‎09-25-2007

Do you have the pre-requisite "login block-for seconds attempts tries within seconds" configured, as specified in this section? I'm not sure how "log on-success ..." worked if the above were not configured.

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b93.html#wp1027195

Also, according to this document

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/hsec_c/part30/h_login.htm

"Logging messages for failed login attempts are automatically enabled when the auto secure command is issued; they are not automatically enabled for successful login attempts via autosecure."

paulnigel · ‎09-25-2007

Hi Yjdabear,

You are indeed very helpful. yes you are right, it works now!

Thanks much,

Pnigel