Authentication logs are often the fastest way to determine whether a configuration issue was caused by a normal administrative action or by something more suspicious. This workflow is useful for network investigations because it lets you review historical login activity quickly and narrow it to a specific switch and time period.

1. Filter the Relevant Device Type

Open the log overview dashboard and filter for logs coming only from network switches. Then add another filter for successful logins so the result set contains authenticated access only.

Log overview in Logmanager filtered to switch-related events and successful logins
Fig. 1: Log overview in Logmanager filtered to switch-related events and successful logins.

2. Adjust the Time Range

Set the time interval to the period that matters for your investigation. In the example, the second week of November is selected so the results focus on the time around the suspected misconfiguration.

3. Narrow to the Affected Switch

If suspicion is focused on one device, add that device as another filter. For example, narrowing the search to the headquarters switch makes it easier to review only access tied to that asset.

Switch login investigation filtered to a specific device and time range in Logmanager
Fig. 2: Switch login investigation filtered to a specific device and time range in Logmanager.

3. Review the Usernames

Add the username field or filter for it directly. If the results show only a known authorized user, that is a strong sign the incident was likely a normal mistake rather than malicious access.

Username-based review of successful switch logins in Logmanager
Fig. 4: Username-based review of successful switch logins in Logmanager.