Current position:  Home > Default > Security logs for UNIX

Security logs for UNIX

Time:October 11
Advertisement
We have some user that cant get access to our box from an external location.
We keep getting user authentication errors. We have verified passwords, permissions, and no changes have been made to host file.
Is there a log that will give me information about unsuccessful logins to the server?
I am looking in /var/log but see nothing that is giving me the info I need.
EG: I can see in the file messages, information about last opened sessions, but I see nothing for any denials.
Thanks,
AIX 5.2
Oracle 9.
DA
Edited by: Dan A on Mar 17, 2009 7:06 AM
Advertisement
The failedlogin doesnt exist either
I am trying to simply create the btmp file (with 777 set, owner is root:root) but after failing the logins many times there are still no entries there.
Will continue search!
Actually, I just created the btmp with the same permissions, owner and group as the wtmp but still nothing generated in there. . .
Now, when we use the command lastb
we get
btmp begins Tue Mar 17 11:37:26 2009
If this means it is enabled, we still get no entries when we try to login in a "bad" way.
Edited by: Dan A on Mar 17, 2009 8:34 AM

How to stop QuickTime Streaming messages in secure.log?

-0001-11-30

The secure.log of the server is flooded with these kind of messages: Jan 25 12:13:08 server com.apple.SecurityServer[41]: Succeeded authorizing right 'com.apple.server.admin.streaming' by client '/usr/sbin/QuickTimeStreamingServer' for authorization

Secure.log and log rotation problems

-0001-11-30

I had originally posted this in the Tiger section, but now finding the Unix section which I think would be able to help me more. here is the link to the post: http://discussions.apple.com/thread.jspa?threadID=1913487&tstart=0 Also I am getting this i

System and security logs

2015-10-11

1. Login, Clear Logs and log off events in Windows 2003 when does this happen and what are the IDs for these events ?  what is the system login? 2. In an event when administrator account and password are shared by more than one person, is it is possi

Unable to receive an email by task scheduler on audit failure in windows server 2008 r2 security log

2015-10-11

Deal All, I am sorry in advance if i would be on wrong forum, i have created a task on Server 2008 r2 Domain controller that when an audit failure event triggered in windows security log then an email should reach on my email ID, but unfortunately, n

Only one Server Audit can write to Security Log

2015-10-11

Hi, I have a problem when i want to enable a second audit server to security log... Permissions are right, the first Audit Server works fine but when i enable the second i have the 33204 error. (SQL Server Audit could not write to the security log.)

I have created my site with Muse and have uploaded to an external ftp hosting, now my secure log in will not work because I am not using BC. Is there a way to create a secure log in that will work with out being forced to use BC?

2015-10-11

I have created my site with Muse and have uploaded to an external ftp hosting, now my secure log in will not work because I am not using BC. Is there a way to create a secure log in that will work with out being forced to use BC?Hi Secure Zone login

WBEMTEST doesn't give Security logs

2015-10-11

Hi, I did a WMI test and queried to see the security logs. Nothing found. I see only Application and System logs. No security logs were found. I used the below query. select * from win32_ntlogevent Thanks in advance. Rajiv, Technical Support Engineer

System, Firewall,Secure logs

2015-10-11

I need some help with trying to understand the logs and whether they can be safely deleted. The only problem is I am unable to figure out what these logs do or how to delete them. Some are labeled some what oddly. I have run the maintenance scripts,

Windows 2008 member server, repeating event 4625 in the security log

2015-10-11

Hello,    I'm having an issue with a member server on our 2008 domain, security log is filling up with event 4625, here are the details: Log Name:      Security Source:        Microsoft-Windows-Security-Auditing Date:          4/23/2014 2:04:42 PM Ev

Firefox will not open a new, secure log-in page, on my bank's site

2015-10-11

My Bank's website opens a new, secure, log in page from a link on its home page. When I click on this link to do so, nothing happens. No window opens and Firefox does not give any messages as to why. It used to work, but has stopped in the last coupl

Permission Report (secure.log & ALRHelperJobs)

-0001-11-30

Hi, I usually ignore permission reports since after I repair them I get "Permissions repair complete". First, does "Permissions repair complete" mean they were repaired or not? But I would most importantly like you insight on the follo

802.1x WLAN auth not showing client ip in win 2008 AD security log

-0001-11-30

Hello. I have a ongoing project configuring a cisco wlan with 802.1x, where microsoft network policy server is used for radius authentication. Configuring the SSID on the WLC, and the 802.1x on wlc/radius server works fine, users type in their userna

Private Secure Log Permissions being changed by someone????

-0001-11-30

I have been having to repair the permissions on my ibook often. How do these get changed, by who, and what threat is it to me? How much control over my computer can one get???? Below is the repair I just had to make. Repairing permissions for "Macint

[WRT400N] Several security log entries - every minute

-0001-11-30

I have several entries in the security log that I have no idea where they are coming from. They are all blank like this: Incorrect User login : Username is , Password is From 192.168.1.101=> Wed Mar 17 17:42:48 2010 Incorrect User login : Username is

2012 DC getting numerous 5152 errors in Security log

-0001-11-30

I have a DC running Windows Server 2012 (not R2) which has recently started getting numerous failed audit entries in its security log, ID 5152. The source IP seems to include about half a dozen in use by domain PCs (all Windows 7). The source and des

Security Log entries on domain controllers

-0001-11-30

Hi Everyone, I started working in an environment where they must log all security events due to regulations on one of the domains. It has 200 Windows XP and Windows 7 computers and about 200 users give or take. It has several servers including 2 Wind

WRT600N Security Log

-0001-11-30

Is anyone else having this prob? When I view my logs , my security log keeps saying incorect username-password=admin and gives my laptop pc address. Starnge even though i can lod in with no probs with my password. I am hoping this is just a bug that

Excessive Logging in Windows Security Logs

-0001-11-30

Hi, We are running a Windows Server 2012 server as a file server.  We have 'Audit object access' turned-on in the Local Security Policy. We have a file share that is enabled for auditing.   We are receiving numerous Event ID 5145, 5156, and 5456 in t

Restoration of /var/log/secure.log from Time Machine Backup

-0001-11-30

I have a need to restore /var/log/secure.log from Time Machine Backup on Lion Server, but can not find any entries for this file in the Time Machine archives even when using the find command.   It seems like it is not backed up.   I'm hoping that thi