Bug ID 793077: Failed SSH logins no longer log entries into the audit log file

Last Modified: Jul 03, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.4, 14.1.0.5, 14.1.0.6

Opened: Jun 13, 2019
Severity: 4-Minor

Symptoms

When using SSH to log into the BIG-IP systems, failed login attempts are no longer being logged in the /var/log/audit log file. Instead failed logins continue to be logged in /var/log/secure log file.

Impact

Log file /var/log/audit no longer shows failed SSH login attempts. Failed logins via GUI continue to be logged in /var/log/audit file.

Conditions

-- Using SSH to log into a BIG-IP system. -- The login attempt fails (e.g., due to invalid credentials).

Workaround

View /var/log/secure log file for failed SSH login attempts.

Fix Information

None

Behavior Change