Drilling down on the 'Alert message console'

[kvoegele]

Hey Guy's,

I am noticing consistent attempts to log into our device from our wan link (shown by the alert message console widget). I have not been able to figure out how to drill down and look at the IP that is trying to gain access. Any help would be greatly appreciated. 

For now I have blocked all telnet and ssh attempts to the wan link and have the https access limited to static public IP's.

Thanks in advance!

[AtiT · Accepted solution]

Hello,

I think it should be logged under Event log -> System.

See the attached screenshot.

[kvoegele]

Thanks for your help. You are correct I just need to add the 'login' filter.