Switch to desktop version  
Security related logging - Printable Version

+- Ewon Technical Forum (https://techforum.ewon.biz)
+-- Forum: Development (https://techforum.ewon.biz/forum-50.html)
+--- Forum: Ewon Embedded Technology (https://techforum.ewon.biz/forum-51.html)
+---- Forum: Ewon Core Features (https://techforum.ewon.biz/forum-3.html)
+---- Thread: Security related logging (/thread-2278.html)

Security related logging - lukasr1 - 03-05-2023

Hello

For IT-security purposes, I need to get security-related information concerning Ewons and eCatcher into a centralized log-monitoring. 
I would like to ingest the following information:
  1. eCatcher logs like https://onlinehelp.ewon.biz/ecatcher/6.8/free/en/users_logs.htm  
  2. When did a user login on a Ewon’s web-interface
  3. When was the last change to the configuration (if possible what was changed)
  4. When was a device restarted
  5. FTP/OPC connections
I read the documentation about Ewon-logging and the m2Web-API but I wasn’t able to get very far. The only thing I achieved was to read the events.txt-file using FTP. From there I can extract if the Ewon was restarted or a user is accessing FTP/OPC. 

Is there a way to get all the security-related information into the events.txt-file? Otherwise, using an API or custom scripts is fine as well.

I have to admit, that my Ewon-knowledge doesn’t really go any deeper than basic settings in the web-UI.
Ewon Flexy 205 are mainly used.

Thank you


Lukas

RE: Security related logging - simon - 04-05-2023

Hi Lukas,

Indeed you can retrieve the event.txt logs from the Ewon using the M2Web API.
However, the connection logs (eCatcher/T2m) cannot be retrieved through this API. There is actually no way to collect them other than exporting them from eCatcher manually.

That is something that is considered in the future, but on a long term perspective...

RE: Security related logging - lukasr1 - 05-05-2023

(04-05-2023, 04:34 PM)simon Wrote: Hi Lukas,

Indeed you can retrieve the event.txt logs from the Ewon using the M2Web API.
However, the connection logs (eCatcher/T2m) cannot be retrieved through this API.  There is actually no way to collect them other than exporting them from eCatcher manually.

That is something that is considered in the future, but on a long term perspective...

Thank you Simon for the fast reply.

Is it possible to get the following two questions by API or directly from the events.txt with FTP? 
  • When did a user login on a Ewon’s web-interface
  • When was the last change to the configuration (if possible what was changed)
Preferably over FTP or other local-network working methods.

RE: Security related logging - simon - 05-05-2023

Hi,

When did a user login on a Ewon’s web-interface --> Unfortunately no.
When was the last change to the configuration (if possible what was changed) --> no