Bug ID 793077: Failed SSH logins no longer log entries into the audit log file

Last Modified: Dec 20, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3,,,,,,,, 12.1.4,, 12.1.5, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1,,,,,, 13.1.3,,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,,,, 14.1.2,,,

Opened: Jun 13, 2019
Severity: 4-Minor


When using SSH to log into the BIG-IP systems, failed login attempts are no longer being logged in the /var/log/audit log file. Instead failed logins continue to be logged in /var/log/secure log file.


Log file /var/log/audit no longer shows failed SSH login attempts. Failed logins via GUI continue to be logged in /var/log/audit file.


-- Using SSH to log into a BIG-IP system. -- The login attempt fails (e.g., due to invalid credentials).


View /var/log/secure log file for failed SSH login attempts.

Fix Information


Behavior Change