Syslog question

are successful logins written somewhere for the gl-inet web admin interface?

I don’t think so. Yes this is good to log.

just successful ones. and make it permanent to survive reboots with a very very small buffer of course if you could suggest please. it’s nice to know when other cooks have been in the kitchen changing the recipe

Actually the failed ones should be logged as well, just as ssh logs.

1 Like

Adding to the OP’s suggestion, an option to enable a notification via goodcloud will also be nice.

some people expose http(s) ports so I figured storing a log 90% full of failed attempts would be annoying. but no complaints here if you do. if anything just logging local failed attempts would be nice too.

Yes. This needs to be done smartly.
For example, if there are 100 failed attempt, 100 notifications could be very annoying.
The correct way may be: send out 1 or several notifications, saying there are 100 failed attempts. The even better ways is to auto block such kind of attack.