Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Can I see who made changes and when?
Short answer
Yes. The User Logs screen (Settings → System Logs → User Logs) lists every configuration change made from the interface, WEB-CLI or the API, the logins and logouts and the failed login attempts with the information of who (Username), when (Date), from where (User IP, User-agent) and on which device (Source). The number in the Changes column and the preview of the record show the old and new value per field. The Filter panel has filters such as Field, Subfield, Object, Action type and Username; the list can be exported and sent to a SIEM with Log Forwarding. Admin sees all records; other users see their own operations and the records of the areas in which they have full permission. For the history of a single object, the Log tab in the preview of the object is used (How do I see the change history of a single vService or Backend Service?).
Problem: The Owner of a Change Is Unknown
The behavior of a vService has changed or a setting is unexpectedly different; who made the change, when, and by changing which value needs to be found.
Solution: Three Methods
For a device-wide search, User Logs is used, and for the history of a single object, the Log tab of that object; for keeping the records outside the device, Log Forwarding is added.
| Your situation | Suitable method |
|---|---|
| Searching all operations device-wide | Method 1: User Logs |
| Seeing the history of a single object | Method 2: Log Tab |
| Keeping the records in a central system | Method 3: Log Forwarding |
Method 1: User Logs Recommended
- How it worksUser Logs records every user operation with the user, time, source and the per-field difference. In a cluster setup, the records of the two devices are listed together; the Source column shows the device on which the operation was performed.
- Where it is openedSettings → System Logs → User Logs
- Requirement Permission to view the Settings menu; among the built-in roles, Admin and Read-only user have it. Admin sees all records; other users see their own operations and the records of the areas in which they have full permission.
- Scope All user operations on the device
Step-by-Step Configuration
1
Adım 1 Open the screen
Configuration Menu → Settings → System Logs → User Logs is opened.
2
Adım 2 Select the time range
The range is selected in the Time Range field; the default is the last 7 days.
3
Adım 3 Get logs
The Get Logs button is clicked. The list does not refresh on its own; for new records, the button is used again.
4
Adım 4 Filter the records
In the Filter panel, for example, Field = Traffic manager and Action Type = Edit, or Username, is selected. For operations made from WEB-CLI, @web-console is added to the User-agent cell, and for those made over SSH, @ssh.
5
Adım 5 Read the difference
The row is clicked; in the Changes tab of the preview, the added (+), deleted (−) and changed (•) values are seen per field.
Verification
1RecordTR7 side
A small change is made on a vService and the list is refreshed with Get logs.
Expected
A new record at the top; the number of changed fields in the Changes columnMethod 2: Log Tab
- How it works The Log tab in the vService, Backend Service and profile previews shows only the operations that belong to that object.
- Where it is opened Object list → row → right panel → Log
- Requirement Permission to view the object.
- Scope A single object
Step-by-Step Configuration
1
Adım 1 Open the Log tab of the object
The object is clicked in the relevant list and the Log tab in the preview is opened. Detailed steps: How do I see the change history of a single vService or Backend Service?
Verification
1TabTR7 side
The last record in the Log tab is checked.
Expected
The last operation made on the object, with the username and timeMethod 3: Log Forwarding
- How it works The Log Forwarding profile sends the user logs to the SIEM together with the change summary.
- Where it is openedSettings → General Settings → Log Forwarding
- Requirement A Syslog server reachable from TR7.
- Scope All user operations on the device
Step-by-Step Configuration
1
Adım 1 Add a Log Forwarding profile
On the Settings → General Settings → Log Forwarding screen, the Add button is clicked and the destination Syslog server is entered.
2
Adım 2 Select User Logs as the source
User Logs is selected in the Log Sources field; Send Change Details is on by default and is left on. The other fields of the profile: How do I send logs to a SIEM (Syslog)?
3
Adım 3 Save
The form is saved with the Add button.
Verification
1SIEMExternal system
A change is made on TR7 and the record is searched in the SIEM.
Expected
A record with the username, the operation and the change summaryCommon Mistakes
- Expecting the new record without pressing Get logs. The list does not refresh on its own.
- Searching for an old change while Time Range is 7 days. The range is widened and Get logs is used again.
- Looking with a non-Admin user and assuming the operations of others do not exist. Admin sees all records; other users see their own records and the records of the areas in which they have full permission.
- Assuming the Object filter also brings the changes of the bound objects. The Object filter brings only the records of the selected object; the history of the Backend Services and profiles bound to a vService is seen in their own Log tabs (How do I see the change history of a single vService or Backend Service?).
How it is done in the documentation
