Sign-in log

Read it

In the portal, open the app → Activity. Each row shows Time, User, Machine, Method, Service and Source IP, and whether the sign-in was allowed or denied, with the reason: wrong code, code already used, too many attempts, user exempt, two-factor disabled on this machine, and so on.

Filter by Machine, User, Method (Push, Authenticator code, Backup code, No code), Result, and a From/To date range. Clear filters resets them.

Pushes from a website or an SDK on the same app appear too, with no machine.

Sign-ins decided offline

• A registered machine appends each sign-in it decides to /var/lib/u2auth/events/pending.jsonl, and sends the queue the next time it reaches U2 Secured (any push does it). Sending never delays or changes a login.
• Those rows say “Reported later · received” and the time U2 Secured received them. A machine clock more than 5 minutes off is pointed out on the row.
• The queue holds 1,000 events and drops the oldest; the log says how many were dropped.
• u2auth-admin sync sends the queue now, for example after an outage, and check shows how many events are waiting.

sudo u2auth-admin check     # registration, and how many events are waiting
sudo u2auth-admin sync      # send them now

Gaps

Each event carries a sequence number, so one that never arrives shows as a gap, for example “Events 2–2 from web-01-ssh were never received”. Root on a machine can delete or rewrite its queue, or keep the machine offline: the log makes tampering visible, it does not prevent it.

What it does not show

• Logins that never go through U2 Secured: users outside u2mfa, and services not gated.
• Anything an unregistered machine decided by itself (offline codes, bypass users, the emergency switch). It never reports them, so register every machine.
• The ForceCommand route (login_u2auth): its pushes appear, nothing it decides locally does.
• Anything from a machine that never reconnects.

For those, and for anything that must be provable, use the machine’s own logs, and ship syslog off the machine: the helper logs every decision with the tag u2auth.

journalctl -t u2auth --since today     # every U2 Secured decision, with reason=
last -a                                # sessions that were opened
sudo less /var/log/auth.log            # sshd, sudo and PAM

failmode

failmode decides what happens when U2 Secured is unreachable and the user has no offline code. secure, the default, refuses (reason=failclosed). safe lets them in (reason=failopen), which turns two-factor off for anyone who can block the machine’s outbound traffic. Keep secure, and enrol offline codes instead.