Logs for Virtual KVM Access

[DCIM_Support]

Does Server Access provides a log on user activities

(1) Who access to a server via KVM / RDP / SSH at which day / time ?

(2) Who power cycle / shutdown a server at which day / time?

(3) What command was executed via a SSH session etc..

(CID:102925315)

[DCIM_Support · Accepted solution]

Hi Bernard,

Unfortunately I'm not able to test it myself at the moment, but to offer you a quick response, in general DCO user activities (inside the DCO) is usually logged and you should be able to generate an "Audit Trail" report. See for example the following capture,it should be possible to run an "Audit Trail", filtered by the event "Server access".

However, concerning the last question, activities outside the DCO cannot be logged by DCO. DCO may only initiate the communication session (such as ssh session), what may happen afterwards will be decided by the target server.

(CID:102925337)

[DCIM_Support]

Jef Faridi that is correct. When a user access a server through the DCO client it is tracked in the audit log. The same goes for power cycling and shutdown. What commands are executed outside of DCO (for instance through ssh) are not in the auditlog

(CID:102925354)

[DCIM_Support]

Many thanks Kresten, Bernard Tan , now you have our developers confirmation as well, thanks.

(CID:102925361)

[DCIM_Support]

Thanks Jef and Kresten for your input. Are you able to share with me a copy of a screen capture how how the audit trail for server access looks like? And also, does that mean that the customer would require to purchase a change license in order to generate the audit log report?

(CID:102925419)

[DCIM_Support]

Hi Bernard, I will see if I can find such a screen capture for you. But the answer to the license question is yes, the "Audit Trail" requires the Change license.

(CID:103583712)

[DCIM_Support]

Thanks Jef Faridi and Greg Sterling for your inputs.

(CID:103583829)

[DCIM_Support]

Hello Bernard.

Here's a screenshot of a couple of audit record events from a pair of server access events. You'll notice I selected the "server access" event type from the audit report view.

Regards

Greg Sterling

(CID:103583786)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.