Avamar: How to determine the IP address of hosts reporting successful and failed login attempts

Summary: This article provides details about determining the host IP addresses associated with Avamar Administrator Console login attempts (both successful and failed).

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

In UNIX, the "last <username>" command is used to check information about the specified username.

This command also provides additional information such as the IP address, and when the login occurred.

As there is no Avamar equivalent, this article provides commands to get comparable information about the UI from the logs for both successful and failed logins).

1. Log in to the Avamar Utility Node as admin.

2. The commands below parse the mcserver logs (/usr/local/avamar/var/mc/server_log/mcserver.log*) and provide the date, IP Address, and Usernames for successful or failed logins:

Note: Audit Code 22339 is "User login successful" and Audit Code 22801 is "User login failure"
 
  • Print the successful logins to the Management Console Server (MCS) UI:
grep "^FINE.*events.*22339.*MCGUI" /usr/local/avamar/var/mc/server_log/mcserver.log.0 | perl -lane 'm/values...(\d+\-\d+\-\d+ \d+:\d+\d+).+host=&amp;quot;(.+?)&amp.+ user=&amp;quot;(.+?)&amp/;print "Date: $1 \t IP Address: $2 \t User Name: $3"'

Example output:

Date: 2024-12-20 04:32   IP Address: 10.n.n.3      User Name: MCUser
Date: 2024-12-20 04:12   IP Address: 10.n.n.3      User Name: MCUser
Date: 2024-12-16 03:07   IP Address: 10.n.n.4      User Name: MCUser
 
  • Print the failed logins to the MCS UI:
grep "^FINE.*events.*22801.*MCGUI" /usr/local/avamar/var/mc/server_log/mcserver.log.0 | perl -lane 'm/values...(\d+\-\d+\-\d+ \d+:\d+\d+).+host=&amp;quot;(.+?)&amp.+ user=&amp;quot;(.+?)&amp/;print "Date: $1 \t IP Address: $2 \t User Name: $3"'

Example output:

Date: 2024-12-20 04:30   IP Address: 10.n.n.3      User Name: MCUser
Date: 2024-12-15 13:25   IP Address: 10.n.n.4      User Name: MCUser
 
  • Print the successful logins to the Avamar Web UI (AUI) (RESTAPI):
grep "^FINE.*events.*22339.*MCREST" /usr/local/avamar/var/mc/server_log/mcserver.log.* | perl -lane 'm/values...(\d+\-\d+\-\d+ \d+:\d+\d+).+host=&amp;quot;(.+?)&amp.+ user=&amp;quot;(.+?)&amp/;print "Date: $1 \t IP Address: $2 \t User Name: $3"'

Example output:

Date: 2024-12-16 02:47   IP Address: 10.n.n.3      User Name: root
Date: 2024-12-16 03:10   IP Address: 10.n.n.3      User Name: root
 
  • Print the failed logins to the AUI (RESTAPI):
grep "^FINE.*events.*22801.*MCREST" /usr/local/avamar/var/mc/server_log/mcserver.log.* | perl -lane 'm/values...(\d+\-\d+\-\d+ \d+:\d+\d+).+host=&amp;quot;(.+?)&amp.+ user=&amp;quot;(.+?)&amp/;print "Date: $1 \t IP Address: $2 \t User Name: $3"'

Example output:

Date: 2024-12-20 04:39   IP Address: 10.n.n.6      User Name: Smurfette
Date: 2024-12-20 04:40   IP Address: 10.n.n.8      User Name: MCUser

Affected Products

Avamar, Avamar, Avamar Data Store Gen3, Avamar Data Store Gen4, Avamar Data Store Gen4S, Avamar Data Store Gen4T, Avamar Data Store Gen5A, Avamar REST API, Avamar Server, Avamar Virtual Edition
Article Properties
Article Number: 000196185
Article Type: How To
Last Modified: 14 Oct 2025
Version:  5
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.