|
Using the FSSO collector agent it is not possible to clear a single user logon event, however, using FortiGate it is possible to clear the single FSSO user logon event using the below commands.
Check all the FSSO users by using the below command:
FGT # diagnose debug authd fsso list
----FSSO logons----
IP: 10.86.9.42 User: SSLVPN2 Groups: DXBLAB/SSLVPNGRP Workstation: BOSON-KVM62 MemberOf: DXBLAB/SSLVPNGRP
IP: 10.87.9.42 User: SSLVPN1 Groups: DXBLAB/SSLVPNGRP Workstation: BOSON-KVM52 MemberOf: DXBLAB/SSLVPNGRP
IP: 10.87.9.78 User: ADMINISTRATOR Groups: DXBLAB/SCHEMA ADMINS+DXBLAB/DOMAIN USERS+DXBLAB/DOMAIN ADMINS+DXBLAB/ENTERPRISE ADMINS+DXBLAB/GROUP POLICY CREATOR OWNERS+DXBLAB/DENIED RODC PASSWORD REPLICATION GROUP+DXBLAB/ADMINISTRATORS+DXBLAB/REMOTE DESKTOP USERS+DXBLAB/USERS Workstation: BOSON-KVM78 MemberOf: DXBLAB/SCHEMA ADMINS DXBLAB/DOMAIN USERS DXBLAB/DOMAIN ADMINS DXBLAB/ENTERPRISE ADMINS DXBLAB/GROUP POLICY CREATOR OWNERS DXBLAB/DENIED RODC PASSWORD REPLICATION GROUP DXBLAB/ADMINISTRATORS DXBLAB/REMOTE DESKTOP USERS DXBLAB/USERS
Using the below command, it is possible to clear a single FSSO user login event:
FGT # diagnose debug authd fsso filter user ADMINISTRATOR --> Set the username as displayed from the above command, also options below are available.
clear Clear all filters.
source Source IP address.
user User name.
group Group name.
server FSSO agent name.
FGT # diagnose debug authd fsso list --> Verify whether there is the same user alone after setting the filter or not.
IP: 10.87.9.78 User: ADMINISTRATOR Groups: DXBLAB/SCHEMA ADMINS+DXBLAB/DOMAIN USERS+DXBLAB/DOMAIN ADMINS+DXBLAB/ENTERPRISE ADMINS+DXBLAB/GROUP POLICY CREATOR OWNERS+DXBLAB/DENIED RODC PASSWORD REPLICATION GROUP+DXBLAB/ADMINISTRATORS+DXBLAB/REMOTE DESKTOP USERS+DXBLAB/USERS Workstation: BOSON-KVM78 MemberOf: DXBLAB/SCHEMA ADMINS DXBLAB/DOMAIN USERS DXBLAB/DOMAIN ADMINS DXBLAB/ENTERPRISE ADMINS DXBLAB/GROUP POLICY CREATOR OWNERS DXBLAB/DENIED RODC PASSWORD REPLICATION GROUP DXBLAB/ADMINISTRATORS DXBLAB/REMOTE DESKTOP USERS DXBLAB/USERS
Total number of logons listed: 1, filtered: 2
FGT # diagnose debug authd fsso clear-logons --> This command clears the logon event for the above set user.
FGT # diagnose debug authd fsso filter clear --> Clear the filter set.
FGT # diagnose debug authd fsso list --> Verify the User list again and check whether the above user is cleared or not.
IP: 10.86.9.42 User: SSLVPN2 Groups: DXBLAB/SSLVPNGRP Workstation: BOSON-KVM62 MemberOf: DXBLAB/SSLVPNGRP
IP: 10.87.9.42 User: SSLVPN1 Groups: DXBLAB/SSLVPNGRP Workstation: BOSON-KVM52 MemberOf: DXBLAB/SSLVPNGRP
|
