Authentication logging

[shiftey]

Hi all,
We're looking to send our Cacti logs to our SIEM. I'm currently assessing the authentication based logs.
We have DEBUG mode enabled.

I've noticed that:

- For successful logins, there is no IP address associated with the user authenticating. Example:
"AUTH LOGIN: User 'username' Authenticated via Authentication Cookie"
or
"AUTH LOGIN: User 'Username' authenticated"

- For failed logins, the username and IP address are contained within the same event.
"AUTH LOGIN FAILED: Local Login Failed for user 'username' from IP Address '1.2.3.4'"

Feature Request:
Can successful login events contain the same information as a failed login event? (Username and IP Address of user)

[macan]

Please create feature request here
https://github.com/Cacti/cacti/issues

[TheWitness]

Console > Utilities > System Utilities > User Log