Login information and Source IP!

khurram
Here to help

Login information and Source IP!

how to find login information in event logs means to know that who has change the settings. Also wants to know how to check the source IP address of a session.

17 REPLIES 17
BrandonS
Kind of a big deal

Organization > change log

 

- Ex community all-star (⌐⊙_⊙)

not appearing in change log i already have checked that.


@BrandonS wrote:

Organization > change log

 


 

BrandonS
Kind of a big deal


@khurram wrote:

not appearing in change log i already have checked that.


@BrandonS wrote:

Organization > change log

 


 


What is not appearing?  The user or the IP address?  The user and the changes should be there (if they were made).  The IP address is only user the user profile so you would have to use their credentials to see it.

 

- Ex community all-star (⌐⊙_⊙)
BrandonS
Kind of a big deal

For the source IP, I have only seen it under 'My Profile' when you click your email on the top right.  I am not sure how you could find the source IP of another user without their credentials though.

- Ex community all-star (⌐⊙_⊙)
Korey
Meraki Employee
Meraki Employee

The Change Log would be the spot to identify changes made to the network. You could then cross reference the time and user and look at the Organization -> Login Attempts page to identify the source IP address the user logged in from.

someone disable the DHCP server from my MS220. In event log i have identified the time but user information is no appearing. There is no log in change log.


@Korey wrote:

The Change Log would be the spot to identify changes made to the network. You could then cross reference the time and user and look at the Organization -> Login Attempts page to identify the source IP address the user logged in from.


 

Korey
Meraki Employee
Meraki Employee

So the change shows up in the change log but without an Admin associated to that change?

event shows in event log not in the change log.


@Korey wrote:

So the change shows up in the change log but without an Admin associated to that change?


 

Korey
Meraki Employee
Meraki Employee

If the DHCP relay IP was changed it should be reflected in the Change Log:

Screen Shot 2018-05-04 at 2.39.57 PM.pngIf a change was made and is not showing up in the change log I would recommend reaching out to support.

it is not the relay agent. I have setup the DHCP server in MX65W which is connected with MS220 and users are connected with the switch too. Someone disable the DHCP server in switch->DHCP server and blocked the MX65w in there.

 

One thing more kindly guide me how to setup the below forma

 

 

BrandonS
Kind of a big deal

Are you trying/Intending to run two different DHCP servers?  Why?

 

It sounds like maybe you saw an error in the event log about DHCP server conflict and one was shut down?

 

Screenshot?

 

 

- Ex community all-star (⌐⊙_⊙)

no its a single DHCP server.


@BrandonS wrote:

Are you trying/Intending to run two different DHCP servers?  Why?

 

It sounds like maybe you saw an error in the event log about DHCP server conflict and one was shut down?

 

Screenshot?

 

 


 

Korey
Meraki Employee
Meraki Employee

Ah, I think I understand now. You are saying someone went in and blocked your MX mac address from being a DHCP server on the switch dhcp page, correct?

 

If so, that modification does not appear to show up in the change log but if you caught a glimpse of a change in the event log I would correlate the time with the Login Attempts to get an understanding of who was logged in at that time. 

yes you are correct. but the admins account are always logged in.

Korey
Meraki Employee
Meraki Employee

Ok, with that in mind it's tough. Reach out to your admins and ask who made a change. 


@Korey wrote:

Ok, with that in mind it's tough. Reach out to your admins and ask who made a change. 



No one is accepting it. Thx.

Korey
Meraki Employee
Meraki Employee

One last ditch, try reaching out to support to see if they can help glean some additional information related to the change that can help you correlate it to an admin. 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels