Hitachi GR2000 Series - Manual (Page 158)

Hitachi Gigabit Router GR2000 Series Enhanced Version Operations - Device Management Overview
6-4 GR2K-GA-0015
Ver. 07-02
6.3 Confirming operation log
6.3.1 Confirming history of login
It is recommended to regularly confirm the history of login to the router for better
security.
6.3.1.1 Confirm users successful in login authentication.
The history of user successful in authentication of login to the router can be
displayed together using the "show logging | grep Login" command. An example of
execution is shown in the figure below.
Figure 6-2 Display of login history
Confirm each user as shown below according to the display result. Please note that
logs containing the message "Login incorrect" is contained are not subject to a check
here because they are collected during failure in login authentication.
1. Confirm that the user of the operation terminal (IP address) coincides with the
user of the login user name. If not, confirm the details of the user of the operation
terminal.
6.3.1.2 Confirm users who failed in remote authentication.
The history of users who failed in login authentication from the remote operation
terminal in which login was not permitted can be displayed together using a "show
logging | grep "Unknown host address" command. An example of execution is shown
in the figure below.
Figure 6-3 Display of login history
6.3.1.3 Confirm users who failed in login authentication.
The history of users who failed in authentication of login to the router can be
displayed together using the "show logging | grep "Login incorrect"" command. An
example of execution is shown in the figure below.
> show logging | grep Login
EVT 07/25 12:11:20 E3 RM 00005002 1001:000000000000 Login operator from
172.16.251.69(ttyp3).
EVT 07/25 11:23:56 E3 RM 00005002 1001:000000000000 Login operator from
172.16.251.106 (ttyp2).
EVT 07/25 11:17:10 E3 RM 00005002 1001:000000000000 Login operator from
172.16.251.67(ttyp1).
[Omitted hereinafter.]
>
> show logging | grep "Unknown host address"
EVT 08/19 10:41:52 E3 ACCESS 00000001 0201:000000000000 Unknown host
address 172
.16.251.69.
>