Undesired event log
Recently I observed there are many undesired information event log in logging console.
The message ""User admin logged in from remote address 118.200.XX.XX" are being logged about 1 min interval repeated as long as the user session is active. Attached is the data event log for your reference.
May I know is it normal behaviour? I assume that it should be sort of audit event whereby only trigger when user session log in and out. If the event log is expected, then I could conclude it may be unauthorise access.
Any help is appreciated. Thanks
phildunlap last edited by
I would not expect a login every minute, but it is weird that you say it is only when the session is active (which I'm guessing means when you are logged in?).
My first question would be if you are using the API to do anything, and perhaps the program using the API is performing a login before whatever calls it is making.
I would also think you could get information from that IP. Is it an IP you could be using? You can google 'what is my ip' to find out your internet facing IP (which that looks like, as opposed to a local network).