Sometimes it is useful to know who has logged onto an appliance that you're looking after. You might want to know who was using the appliance at a particular time, or whether anyone was unable to logon to the appliance. You can even tell who has logged in and not logged out. This information is available through the Appliance Auditing service.

List all of the users who have logged on

To determine the users who logged into an appliance between 09:00 and 18:00 on 7th April 2008:

1. From the Audit section of the Administration tab, select View. The Audit View page is displayed.
   
2. Enter the start of the search period using the From drop-downs.
3. Enter the end of the search period using the To drop-downs.
4. Select logon from the Events drop-down list.
5. Click Run to run the report.
   

What about a particular user?

In the example above, user

logged in at 09:48 and again at 09:57. We can extend the search to determine when he logged out, and can also examine the his actions while logged in. The following search is for logout events, but is limited to the user

. If you have navigated away from the page, you will also have to re-enter the search period.

1. Enter wsmith in the User ID field.
2. Select logoff from the Events drop-down list.
3. Click Run to run the report.
   
    The following report is displayed showing he logged out at 09:53 and 10:18.

What did he do when he was logged in?

The search below shows all auditable actions attributed to user

for the same time period.

1. Select All from the Events drop-down list.

2. Click Run to run the report.
   
    The following report is displayed. This shows that the user 

   wsmith

    logged on, deleted a host node, and then logged off. He logged on again and then ran a generic search query before logging off for the last time in the search period.
   

What else can I find out?

The Events drop-down contains many events that you can search for. For example, pattern management events, appliance configuration changes, discovery command changes, security configuration changes, slave canges, and snapshot operations.