Logging user who runs commands for SZ-CLI user [ICX[

[djninjanz]

Hi Ruckus guys,

vSZ: v6.1.0.0.935

ICX: SPS08095h

When trying to look at logging when using the GUI SZ-CLI option on the SmartZone. I noticed I can't see who has run what command from the GUI. Is this possible?

I have enabled logging of cli commands but it doesn't show the user 😞

Feb 22 08:03:18:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 08:03:08:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:52:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:35:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:32:I:CLI CMD: "show running-config" by SZ-CLI user from telnet client ip
Feb 22 07:38:27:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:19:I:CLI CMD: "show logging" by SZ-CLI user from telnet client ip
Feb 22 07:38:18:I:CLI CMD: "end" by SZ-CLI user from telnet client ip

I have also downloaded the support bundles and searched but haven't seen the user access logs for the user or access to the switch initated by any users.

How can I track what the GUI users are doing on the switches if they access it via the web gui CLI option? Just their public IP address?

[aalvarez6]

Hello, 

You can run this command in the switch to check the users that made changes:
show cli-command-history
Here is the information that you will get:
Slno / Session / User-name / Ip-address / Executed-time/ Command

[djninjanz]

Thanks Aalvarez6

My problem is the SmartZone GUI when using this does not generate who is using it just un-authenticated user. So we have no record of who did what on the switches from SmartZone GUI like so. IP address and un-authenticated user 

[sanjay_kumar]

Hi @djninjanz 
Can you check the "admin activities" on the SZ GUI and see if you can find any details there?

[djninjanz]

Thanks @sanjay_kumar  there is some information there but I don't trust it as the truth for all events.

We have at least 20 support staff working on the vSZ any one day and external 3rd parties who have access. I didn't see any mention of the support staff so i'm not sure what triggers these logs to show up?