logfile for local admin logins


I'm searching for the correct log file for login events of the local firewall user "admin" into Webadmin. Without success.

I cannot find it in the "User authentication daemon" logs - seems there are only AD authenticated logins.

Can you help me out with this simple task?

  • FormerMember
    0 FormerMember 2 months ago

    Hi ,

    Thank you for reaching out to the Community! 

    Check out the aua.log file. 

    Sample logs from my firewall: 

    With correct password: 
    2021:08:27-13:01:08 h_patel-1 aua[21530]: id="3004" severity="info" sys="System" sub="auth" name="Authentication successful" srcip="174.116.xxx.xxx" host="" user="admin" caller="webadmin" engine="local"

    With wrong password:
    2021:08:27-13:03:28 h_patel-1 aua[22788]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="174.116.XXX.XXX" host="" user="admin" caller="webadmin" reason="DENIED"
    aua.log lines 1-7/7 (END)