[ciscodlink]

I'm trying to run a script based on a successful (httpd) Web GUI login, but I can't find anything in /var/log/messages or something like "last_login" in the nvram. Does/can something like this exist?

[msoengineer]

I can't recall what the log file has for sucees (it should show both ok and failed attempts), but I do explicitly recall that when people try to hack in you will for sure see the unsuccessful ones w/ IP and if after 3-5 failed attempts, the code will boot out and ignore that IP address for 5 min.

you'll need to set up a klogd server on the services tab and then use software on a pc like virtual syslog server to watch for the activity.

[Wildlion]

I agree with what is said.

I cannot remember right off hand but I thought the log tab on the gui would record the log ins.