User log Monitoring

[Hussain Mohammed]

Dears,

Currently, M/Monit does not support the feature of user log monitoring. For example, “user1 stops service1”, this action which has been done from the M/Monit is not being recorded in the MMonit log files which would be critical for auditing in case of the attacker could attack user1 and performing some actions like stopping services, restart services, …etc. or in example if user1 performs unauthorized action we couldn’t able to give evidence that he did this action, because MMonit logs do not show the user who did the action in MMonit. . !

Regards.

[Tildeslash]

Issue #1051 was marked as a duplicate of this issue.

[Tildeslash]

Hello,

‌

you can uncomment the <AccessLogger> element in the conf/server.xml file and restart M/Monit to get log of all M/Monit requests.

Best regards

[Hussain Mohammed]

Dears,

Already <AccessLogger> element in the conf/server.xml file is uncommented as below:

AccessLogger directory="logs" fileName="localhost_access.log" rotate="month" />

However, as the explanation in the ticket description, user action logs is not recorded. For example, if “user1” stop “service1”. This action is not recorded in the logs. Thus, we will not be able to perform auditing for the unauthorized actions that were taken by i.e. user1. Thus, MMonit not providing user log monitoring! Please advice.

[Tildeslash]

The user action is logged to the logs/<hostname>_access.log as a POST request to /admin/hosts/action, for example:

127.0.0.1 - admin [01/Nov/2022:19:29:41 +0100] "POST /admin/hosts/action HTTP/1.1" 200 31 "http://127.0.0.1:8080/status/hosts/detail?id=7587" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"

The first field is the client’s IP address, followed by M/Monit username, the referral shows the related host id.

We’ll improve the auditing of user actions in some future release.

[Hussain Mohammed]

Dears,

Thanks for your kind efforts. It would be highly appreciated.

‌