nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Logging user who runs commands for SZ-CLI user [ICX[

djninjanz

Hi Ruckus guys,

vSZ: v6.1.0.0.935

ICX: SPS08095h

When trying to look at logging when using the GUI SZ-CLI option on the SmartZone. I noticed I can't see who has run what command from the GUI. Is this possible?

I have enabled logging of cli commands but it doesn't show the user 😞

Feb 22 08:03:18:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 08:03:08:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:52:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:35:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:32:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:27:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:19:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:18:I:CLI CMD: "end" by SZ-CLI user from telnet client ip

I have also downloaded the support bundles and searched but haven't seen the user access logs for the user or access to the switch initated by any users.

How can I track what the GUI users are doing on the switches if they access it via the web gui CLI option? Just their public IP address?

Find more posts tagged with

Accepted answers

All comments

aalvarez6

Hello,

You can run this command in the switch to check the users that made changes:
show cli-command-history
Here is the information that you will get:
Slno / Session / User-name / Ip-address / Executed-time/ Command

djninjanz

Thanks Aalvarez6

My problem is the SmartZone GUI when using this does not generate who is using it just un-authenticated user. So we have no record of who did what on the switches from SmartZone GUI like so. IP address and un-authenticated user

sanjay_kumar

Hi @djninjanz
Can you check the "admin activities" on the SZ GUI and see if you can find any details there?

djninjanz

Thanks @sanjay_kumar there is some information there but I don't trust it as the truth for all events.

We have at least 20 support staff working on the vSZ any one day and external 3rd parties who have access. I didn't see any mention of the support staff so i'm not sure what triggers these logs to show up?

Chandini

Hi Djninjanz

Thank you for reverting back to us. I suppose more analysis may be needed with the concern you have with SZ and ICX switch.

Please log a ticket with us using the below link so that we can help you with further troubleshooting and isolation.

https://support.ruckuswireless.com/contact-us

Thanks

djninjanz

Sure thing Case ID: 01442801

Chandini

Hi Djninjanz

Ack and Thanks