This log contains more detail (including IP addresses of the server as shown in the figure) on activity run from the Web interface (including errors) than the Linux access security log. Also, this log shows all actions taken from the Web interface by listing the programs that are run and their parameters. The program names are the key to understanding the action performed.

What to look for in this log:

• …w_lan_sec2indicates access to the firewall page; …w_dolansec2” indicates a change to the firewall settings:

  20041109:105526000:2440:httperr:MED:[error] [client 192.11.13.5] w_dolansec running command: /usr/bin/sudo/opt/ecs/sbin/ip_fw -w 2>&1 , referer: https://192.11.13.6/cgi-bin/cgi_main?w_lan_sec

  20041109:105412000:2435:httperr:MED:[error] [client 192.11.13.5] w_lan_sec: calling exec: sudo /opt/ecs/web/cgi-bin/w_lan_sec2, referer: https://192.11.13.6/cgi-bin/cgi_main?susers_menu

• Changes to the system configuration appear in the log as w_config…