Who is currently using/logged into Malcolm

[trwagner1]

Is there a way to see who is currently using Malcolm or to see login history?

Thanks

Ted

[mmguero]

Not so much "login history" exactly, but you can approximate this by looking at query/request history and seeing the users who made those queries/requests. There are two places you'd see this sort of thing:

• Dashboards
  • first, edit ./confiv/nginx.env and set NGINX_LOG_ACCESS_AND_ERRORS to true, then restart Malcolm
  • open Dashbaords, go to the nginx Access and Error Logs dashboard under the Malcolm and Third-Party Logs section of the navigation pane
  • I think it was an oversight that it wasn't there before, but for the next release I've added the username field as a column to the nginx Access Log table at the bottom of that dashboard. In the meanwhile, you can open up individual entries to see the related.user field, or you can enable that column like this:

Kazam_screencast_00000.mp4

• Arkime
  • Open Arkime, go to the History tab along the top
  • the history page looks something like this, note the User ID column

So as Malcolm doesn't track a "login event" as-such, you can see individual requests to resources and group them by the user that requested them (or attempted to request them).

[trwagner1]

Thanks. I was wondering if the access logs for ngix was the answer. Thanks for considering adding the username as a column to the ngix access log in the next release.