CommandLog_Command
The CommandLog_Command contains the Kron PAM proxy command logs. Commands used via SSH/Telnet, SFTP, and SQL Proxy are stored in the database and sent to the Syslog server, if they are defined. The packets are sent to the server in the following format:
sessionId | Specific ID of the log in the PAM Database |
|---|---|
username | The username used to log in to PAM and execute the command |
Host | Kron PAM Host IP |
tenantId | Tenant, the command log was captured. |
sessionStartTime | When the session started |
sessionEndTime | When the session finished |
globalUserName | GlobalUserName that used for authentication |
clientIp | Source IP of the device that executed the command |
commandTime | Exact time the command was executed |
command | Executed command |
allowed | If the executed command is allowed by the administrator or not If allowed=true: authorized, the command can be executed If allowed=false: unauthorized, the command canβt be executed |
instanceName | Which instance executed the command |
deviceGroups | Group name of the device on which the command is executed |
context | Indicates the terminal session context in which the command was executed. |
Example:
The test user executes the date command, configured as White Key on Kron PAM:
The test user executes the logout command, configured as Black Key on Kron PAM:
ο»Ώ