Which log file should the BIG-IP Administrator check to determine if a specific user tried to log in to the BIG-IP Configuration Utility? (Choose one…

The /var/log/secure log file is the central location for recording authentication-related events on a BIG-IP system. It captures messages from the Pluggable Authentication Modules (PAM) framework. This includes successful and failed login attempts to all management interfaces, such as the web-based Configuration Utility (processed by httpd) and the command-line interface (via sshd). An administrator would review this file to audit user access, investigate unauthorized login attempts, and troubleshoot authentication issues.

A. /var/log/pam/tallylog is a binary data file used by the pamtally2 module to track failed login attempts for account lockout purposes, not a human-readable log.

C. /var/log/ltm contains logs specific to the Local Traffic Manager (LTM) module, such as pool and node status changes, not management authentication events.

D. /var/log/httpd contains the access and error logs for the Apache web server that runs the Configuration Utility, but detailed authentication messages are syslog'd to /var/log/secure.

- F5 Networks. (2021). BIG-IP System: Administration Guide. Chapter: "Logging and Reporting". The guide describes the purpose of various log files, identifying /var/log/secure for authentication messages.

- F5 Support. (2022). K16197: Reviewing BIG-IP log files. This article provides a table of common log files and their purposes, specifying that /var/log/secure contains "Information related to authentication and authorization."