Request Demo
Features Use Cases About Documentation Contact Request Demo

Audit Logging

Track authentication events and admin activity

What Gets Logged

Warden maintains comprehensive logs for security, compliance, and troubleshooting. Every significant event is recorded:

Authentication Events

  • Successful and failed login attempts
  • User identity and credentials used
  • Host/device that made the request
  • 2FA method and result
  • Reason for any rejections

Admin Activity

  • Configuration changes
  • User and group modifications
  • Policy updates
  • Host/host group changes
  • Admin portal logins

RADIUS Accounting

  • Session start and stop
  • Session duration
  • Data transferred (in/out)
  • Disconnect reason
  • Device MAC addresses

Viewing Logs

Access logs through the Warden dashboard:

  1. Go to Logs in the sidebar
  2. Select the log type (Authentication, Admin, Accounting)
  3. Use filters to narrow results by date, user, host, or status
  4. Click any entry to view full details

Filtering Tips

  • Use the date range picker for specific time periods
  • Filter by "Failed" to quickly find authentication problems
  • Search by username to see a user's activity history
  • Filter by host to see what's happening on a specific device

Log Entry Details

Each authentication log entry contains:

Timestamp
When the event occurred (UTC)
Event Type
Authentication, Accounting-Start, Accounting-Stop, etc.
Result
Accept, Reject, or Challenge
Username
The identity that was authenticated
Host
The network device that sent the request
Calling Station
Client MAC address (if provided by host)
Identity Provider
Which identity provider was used
2FA Used
Whether 2FA was required and the method
Reject Reason
Why authentication failed (if applicable)
Response Attributes
RADIUS attributes returned on success

Exporting Logs

Export logs for compliance, analysis, or integration with external systems:

  1. Apply filters to select the logs you want
  2. Click Export
  3. Choose format (CSV, JSON, or Syslog)
  4. Download or configure automatic export
CSV

Spreadsheet-friendly format for Excel, Google Sheets, or database import

JSON

Structured data for programmatic processing and APIs

Syslog

Standard format for SIEM integration (Splunk, ELK, etc.)

Real-Time Log Streaming

For immediate visibility, configure Warden to stream logs to external systems:

Syslog Configuration

  1. Go to Settings > Logging
  2. Enable Remote Syslog
  3. Enter your syslog server address and port
  4. Select protocol (UDP or TCP/TLS)
  5. Choose which log types to stream

SIEM integration: Most SIEM platforms (Splunk, ELK, Graylog, QRadar) can ingest Warden's syslog format directly. Check our integration guides for platform-specific setup.

Log Retention

Configure how long logs are kept:

Log Type
Default Retention
Configurable
Authentication
90 days
Yes (30-365 days)
Admin Activity
365 days
Yes (90-365 days)
RADIUS Accounting
90 days
Yes (30-365 days)

Compliance note: Many regulations (PCI-DSS, HIPAA, SOC 2) require specific retention periods. Check your compliance requirements before reducing defaults.

Using Logs for Troubleshooting

When authentication fails, logs are your first stop:

Common Investigation Steps

  1. Filter by the username or MAC address having issues
  2. Look at the "Reject Reason" field
  3. Check if the correct identity provider was tried
  4. Verify the host is recognized and has a valid policy
  5. Look for patterns - same time every day? Same host?

Common Reject Reasons

Invalid credentials Password is wrong or user doesn't exist
Account disabled User account has been deactivated
Group not allowed User's group isn't permitted by the policy
2FA required but not provided User needs to enter their 2FA code
Invalid 2FA code Code was wrong or expired
Time restriction Access not allowed at this time
Unknown host Request came from unregistered device

For complex issues, use NAC Tracer to see the full authentication flow step-by-step.

Security Monitoring

Use logs proactively to detect security issues:

  • Multiple failed logins - May indicate brute force attempts
  • Logins from unusual hosts - Could be unauthorized devices
  • Off-hours activity - Suspicious if users typically work 9-5
  • Disabled account attempts - Someone trying credentials that shouldn't work
  • Admin changes - Unauthorized configuration modifications

Alert setup: Configure alerts in Settings > Alerts to get notified of suspicious patterns automatically. Set thresholds for failed logins, unusual times, and configuration changes.

What's Next?

Back to Help Overview