Results 1 to 3 of 3

Thread: DelegateAuth in audit.log

  1. #1
    Krishopper is offline Dedicated Member
    Join Date
    Dec 2006
    Location
    Minneapolis MN
    Posts
    777
    Rep Power
    9

    Default DelegateAuth in audit.log

    What is DelegateAuth ?

    2007-05-16 06:00:19,891 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountidgoeshere>; accountName=user@domain.com;

    The user is not an administrator, so should I be concerned that there is something port 7071 for them?

  2. #2
    jholder's Avatar
    jholder is offline Former Zimbran
    Join Date
    Oct 2005
    Location
    Thatcher, AZ
    Posts
    5,606
    Rep Power
    20

    Default

    Code:
    [ip=127.0.0.1;name=zimbra;]
    Looks like a Zimbra operation that is affecting a user. Have you changed something in the admin console in respect to this user?

  3. #3
    Krishopper is offline Dedicated Member
    Join Date
    Dec 2006
    Location
    Minneapolis MN
    Posts
    777
    Rep Power
    9

    Default

    No I was not.

    It looks like it happens regularly.

    audit.log:2007-05-17 06:11:19,058 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-08:2007-05-08 06:00:23,749 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-08:2007-05-08 08:49:44,455 INFO [http-7071-Processor48] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-08:2007-05-08 08:50:06,388 INFO [http-7071-Processor49] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-08:2007-05-08 08:50:57,849 INFO [http-7071-Processor48] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-09:2007-05-09 06:00:19,153 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-10:2007-05-10 06:00:23,142 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-11:2007-05-11 06:00:21,424 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-12:2007-05-12 06:00:18,294 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-13:2007-05-13 06:00:24,355 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-14:2007-05-14 06:00:24,341 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-15:2007-05-15 06:00:24,771 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
    audit.log.2007-05-16:2007-05-16 06:00:19,891 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;

    I also see it for my spam@ and notspam@ accounts too

    audit.log.2007-05-12:2007-05-12 23:00:26,390 INFO [http-7071-Processor47] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-12:2007-05-12 23:00:39,716 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-12:2007-05-12 23:45:16,432 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-12:2007-05-12 23:45:27,206 INFO [http-7071-Processor47] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-13:2007-05-13 23:00:20,948 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-13:2007-05-13 23:00:33,108 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-13:2007-05-13 23:45:17,305 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-13:2007-05-13 23:45:27,206 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-14:2007-05-14 23:00:24,897 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-14:2007-05-14 23:00:35,366 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-14:2007-05-14 23:45:16,249 INFO [http-7071-Processor49] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-14:2007-05-14 23:45:26,083 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-15:2007-05-15 23:00:40,717 INFO [http-7071-Processor46] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-15:2007-05-15 23:00:51,712 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-15:2007-05-15 23:45:16,594 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-15:2007-05-15 23:45:26,353 INFO [http-7071-Processor46] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-16:2007-05-16 23:00:21,915 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-16:2007-05-16 23:00:33,331 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
    audit.log.2007-05-16:2007-05-16 23:45:33,504 INFO [http-7071-Processor49] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
    audit.log.2007-05-16:2007-05-16 23:45:45,481 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;

    They all seem to mostly be happening "on the hour" except for a few that are happening at 23:45.

    I checked /var/cron and there are no cron jobs on the system set to run at those times either, so things are not being called administratively. "last" does not show anyone logged into the system interactively at those times.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •