topic Re: Logging user who runs commands for SZ-CLI user [ICX[ in SmartZone and Virtual SmartZone

Logging user who runs commands for SZ-CLI user [ICX[

djninjanz — Wed, 22 Feb 2023 08:06:58 GMT

Hi Ruckus guys,

vSZ: v6.1.0.0.935

ICX: SPS08095h

When trying to look at logging when using the GUI SZ-CLI option on the SmartZone. I noticed I can't see who has run what command from the GUI. Is this possible?

I have enabled logging of cli commands but it doesn't show the user 😞

Feb 22 08:03:18:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 08:03:08:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:52:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:35:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:32:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:27:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:19:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:18:I:CLI CMD: "end" by SZ-CLI user from telnet client ip

I have also downloaded the support bundles and searched but haven't seen the user access logs for the user or access to the switch initated by any users.

How can I track what the GUI users are doing on the switches if they access it via the web gui CLI option? Just their public IP address?

Re: Logging user who runs commands for SZ-CLI user [ICX[

aalvarez6 — Fri, 24 Feb 2023 17:02:35 GMT

Hello,

You can run this command in the switch to check the users that made changes:
show cli-command-history
Here is the information that you will get:
Slno / Session / User-name / Ip-address / Executed-time/ Command

Re: Logging user who runs commands for SZ-CLI user [ICX[

djninjanz — Sun, 26 Feb 2023 18:30:05 GMT

Thanks Aalvarez6

My problem is the SmartZone GUI when using this does not generate who is using it just un-authenticated user. So we have no record of who did what on the switches from SmartZone GUI like so. IP address and un-authenticated user

Re: Logging user who runs commands for SZ-CLI user [ICX[

sanjay_kumar — Mon, 27 Feb 2023 07:00:01 GMT

Hi @djninjanz
Can you check the "admin activities" on the SZ GUI and see if you can find any details there?

Re: Logging user who runs commands for SZ-CLI user [ICX[

djninjanz — Mon, 27 Feb 2023 07:09:06 GMT

Thanks @sanjay_kumar there is some information there but I don't trust it as the truth for all events.

We have at least 20 support staff working on the vSZ any one day and external 3rd parties who have access. I didn't see any mention of the support staff so i'm not sure what triggers these logs to show up?

Re: Logging user who runs commands for SZ-CLI user [ICX[

Chandini — Wed, 01 Mar 2023 16:47:33 GMT

Hi Djninjanz

Thank you for reverting back to us. I suppose more analysis may be needed with the concern you have with SZ and ICX switch.

Please log a ticket with us using the below link so that we can help you with further troubleshooting and isolation.

https://support.ruckuswireless.com/contact-us

Thanks

Re: Logging user who runs commands for SZ-CLI user [ICX[

djninjanz — Wed, 01 Mar 2023 18:43:31 GMT

Sure thing Case ID: 01442801

Re: Logging user who runs commands for SZ-CLI user [ICX[

Chandini — Thu, 02 Mar 2023 08:20:35 GMT

Hi Djninjanz

Ack and Thanks