Authentication - Logout
Introduction
A USER_LOGOUT event records that a signed‑in user ended a session on the ADS‑TEC IRF1000/IRF3000 device. It confirms that the appliance removed the session token and that the web interface or service acknowledged the logout request. Monitor these events to detect unusual behavior, for example rapid logouts across many accounts, administrator logouts outside maintenance windows, or logouts coming from unexpected sources. If you see logouts without a preceding successful login for the same user, investigate possible session hijacking, credential sharing, or misuse of shared accounts.
Webinterface View
The current VIEW page lists authentication events in the Authentication audit table. It shows USER_LOGIN, USER_LOGOUT, and USER_END entries together. During an active login‑ban period, failed login attempts are not logged and therefore do not appear in this view. For a USER_LOGOUT the row is displayed as follows.
| Web column | Description | Example |
|---|---|---|
| Date | Local device date of the event | 10/14/25 |
| Time | Local device time of the event | 14:17:05 |
| Username | Account name whose session was ended | admin |
| Action Taken | Human‑readable action text | logged-out |
| Session | First four characters of the session hash (SHA‑256 of session ID) | 0b93 |
| Method | Origin of the request: web (incl. JSON‑RPC) or adsdpd |
web |
| Source | Request source. IP address for web, MAC address for adsdpd. Can be empty if unknown |
— |
| Reason | Error text if the logout failed. Empty on success | — |
| Result | Outcome of the operation: success or failure |
success |
Use the Session column to correlate the logout with the matching login that has the same hash prefix. Use Method and Source to verify that the logout came from the expected client and access path.
Explanation of the raw audit.log entry
A USER_LOGOUT entry in audit.log contains standard auditd header fields and an embedded message payload with logout details. The device does not change auditd’s default behavior; for generic field semantics refer to the official auditd documentation.
| Field | Description | Example |
|---|---|---|
| type | Audit message type | USER_LOGOUT |
| msg (header) | Timestamp and record ID from auditd | audit(1760444225.960:84) |
| pid | Process ID writing the record (rpcd) |
5447 |
| uid | Effective UID of the process | 0 |
| auid | Audit UID (set by auditd) | 4294967295 |
| ses | Audit session ID (set by auditd) | 4294967295 |
| msg.op | Operation label | user-logout |
| msg.acct | Username of the account | admin |
| msg.exe | Source component: web or adsdpd |
web |
| msg.hostname | Hostname. Not used on this device | ? |
| msg.addr | Source address. IP (web) or MAC (adsdpd). May be unknown | ? |
| msg.terminal | First four characters of the SHA‑256 hash of the session ID | 0b93 |
| msg.reason | Error reason on failure; empty on success | |
| msg.res | Result of the operation: success or failure |
success |
| UID | Human‑readable UID label from auditd | root |
| AUID | Human‑readable AUID label from auditd | unset |
The msg.terminal value matches the Session column in the web view. The msg.exe and msg.addr fields correspond to the Method and Source columns and can be used in a SIEM or SOC to verify which access path and client performed the logout.
When the event is generated
The USER_LOGOUT event is generated when the rpcd process handles a Logout action and calls the audit_log_acct_message() function from libaudit. This creates an audit record that is written to audit.log.
On this device it means that the user actively ended the session, usually by pressing the Logout button in the web interface, or that a component requested active removal of a session. The exe field shows the method: web (includes JSON‑RPC calls made by the GUI) or adsdpd. The terminal field contains the first four characters of the SHA‑256 hash of the session ID. The addr field is the request source: for web this is an IP address, for adsdpd this can be a MAC address. The res field reports success or failure. The reason field contains an error reason on failure and is empty on success. The hostname field is not populated on this device. Standard auditd fields (pid, uid, auid, ses, UID, AUID) are set by auditd according to its defaults.
Sample audit.log entry
type=USER_LOGOUT msg=audit(1760444225.960:84): pid=5447 uid=0 auid=4294967295 ses=4294967295 msg='op=user-logout acct="admin" exe="web" hostname=? addr=? terminal=0b93 reason= res=success'UID="root" AUID="unset"