Auditing Failed Logons

To view the details of user logons to the eG Enterprise system that failed, use the failed logon reports. Using such a report, you can figure out which were the login attempts that failed and why. The reasons can bring to light problems in the network connection that need to be repaired, and even login attempts that are rather ‘suspect’.

1. Login to the eG administrative interface as admin.
2. Select the Failed Logons option from the Audits tile.
3. The default Timeline for the report is 24 hours. You can choose any other fixed period from the Timeline list, or select the Any option from this list. Choosing the Any timeline, allows you to provide a From and To date and time for report generation. If you change the Timeline settings, then make sure that you click the right-arrow button at its end, to register the changes.
4. Next, select the User whose login attempts you want to audit. By default, the All option is displayed here, indicating that the report provides the details of failed login attempts of all users to the eG Enterprise system. However, if only one user had had problems logging in till date, then, by default, that user’s name is displayed in the User list.

5. Administrators can configure the target environment for monitoring by directly logging into the eG administrative interface or by using the admin command line interface provided by the eG manager. This is why, by default, the audit log not only captures user logins via the web-based eG management console, but also those logins that are performed via the eG Admin Command Line Interface.

   While generating audit log reports, you have the option of viewing the details of failed logins across both these interfaces, or only those that pertain to a particular interface. To indicate your choice, use the Interface drop-down list. The options available in the Interface list are as follows:

   • Web: Select this option to view the details of login failures that occurred when attempting to login via the web-based eG management console;
   • Command Line: Select this option to view the details of login failures that occurred when attempting to login via the admin command line interface;
   • All: Select this option to view the details of all login failures, regardless of interface used to login.

   If required, you can choose not to maintain audit logs for activities performed via the admin command line interface by setting the Include activities from the admin command line interface flag in the auditlog section of the manager settings page to No. In this case therefore, the Interface drop-down list will not appear.

6. Finally, click the Show button to generate the report.

   

   Figure 1 : Report displaying the details of failed user logons

7. The resulting report provides details of every login made by the chosen user(s) that failed. These details include (see Figure 1):

   • the name of the user
   • the IP address of the host from which the user attempted to login to the eG management console
   • the Interface type that was used - whether web or command line
   • the exact time of the login attempt
   • the reason for the login failure
8. You can print the report by clicking on the Print icon at the right, top corner of Figure 1, or save the report as a PDF file by clicking on the Save icon. You can even save the report as a CSV file by clicking on the csv icon in Figure 1.

9. You can also schedule the audit log report to be automatically emailed to specific recipients at configured intervals. For that, click on the Schedule this Report icon in the tool bar. Figure 2 will then appear.

   

   Figure 2 : Scheduling an Audit Log report

10. Provide the following in Figure 2:

    • Specify the Schedule Name.

    • Indicate how frequently you want eG Enterprise to mail the report by picking an option from the Mail drop-down. The options provided therein include: Hourly, Daily, Day(s) of the week, Weekly, Monthly, Weekend, and Month-End. If you select the Day(s)of the week/Weekly option, you even get to select the exact day(s) of the week on which you want the report mailed, from the Mail On list. If you select the Monthly option from the Mail list, you can select the exact date of the month on which you want the report to be mailed, from the Mail On list. Select the Hourly option if you want the report to be mailed during a specific one-hour time window on chosen days of the week. In this case, use the Start Hr and End Hr controls to configure the time window for email delivery, and use the Mail On list to select the days of the week.

      Note:

      • If a report is set to be mailed 'Weekly', such a setting only ensures that the report is mailed once a week; it does not alter the Timeline of the original report. The same applies to 'Monthly' schedules.

      • By default, WeekEnd reports are mailed every Sunday. This default setting can however, be modified by editing the eg_services.ini file (in the <EG_INSTALL_DIR>\manager\config directory). The ScheduleMailWeekend parameter in the [MISC_ARGS] section of this file is set to Sunday, by default. If you so wish, you can specify any other day of the week against this parameter, as shown below:

        [MISC_ARGS]

        ScheduleMailWeekend=Friday

    • Provide a comma-separated list of Mail IDs to which the audit log report is to be emailed.

    • Indicate how you want the audit log report sent via email - as an attachment, or in the body of the email. Pick the Attachment option if you want the report to the attached to the email. To include the report in the body of the email, select the Inline option.

    • Then, indicate the Schedule Type. You can indicate when report scheduling is to occur by picking an option from the Schedule Type list. To generate schedule reports at the end of every day, pick the Day-End option from this list. To generate schedule reports at a configured time every day, pick the Anytime option from this list, and then indicate the exact time of generation using the Schedule at time controls that then appear.

    • Then, click on Save to save the schedule.