Authentication - Session Timeouts
Introduction
USER_END records that an authenticated session ended because the configured idle timeout expired. It applies to Web UI and JSON‑RPC API sessions on ADS‑TEC Industrial IT IRF1000 and IRF3000. The default timeout is 300 seconds. Any interaction with the Web UI resets the timer. Any valid JSON‑RPC request resets the timer.
Use this event to verify that unattended sessions are closed automatically. Investigate frequent USER_END events for privileged accounts, because they can indicate open operator consoles that are not logged out. Check the Source value for unknown IP addresses (web) or MAC addresses (adsdpd). For OT networks, configure a strict timeout on /priv/priv.php?id=USERS_SECURITYSETTINGS.
Webinterface View
The Authentication audit view in the current VIEW web interface displays authentication‑related audit entries in one table. It includes successful and failed logins (USER_LOGIN), explicit logouts (USER_LOGOUT), and idle timeouts that end a session (USER_END).
During an active login‑ban period, failed login attempts are not logged, so you may see time gaps between visible failed logins. The Session column displays the first four characters of the session hash. Method shows web (including JSON‑RPC access) or adsdpd. Source is the origin of the request: an IP address for web access or a MAC address for adsdpd service access.
The columns are mapped as follows:
| Field | Description | Example |
|---|---|---|
| Date | Local device date of the event | 10/14/25 |
| Time | Local device time of the event | 10:26:31 |
| Username | Account name that owned the session | admin |
| Action Taken | Normalized action text. For a timeout it shows ended-session |
ended-session |
| Session | First four characters of the session hash | d4ec |
| Method | Login method. web includes JSON‑RPC; adsdpd is the device service |
web |
| Source | Origin address. IP for web, MAC for adsdpd. May be empty if unknown | 192.0.2.15 |
| Reason | Error reason text if available. Empty on a normal timeout | |
| Result | Outcome of the operation (success or failure) |
success |
Explanation of the raw audit.log entry
Each idle timeout writes a USER_END record into audit.log. Standard auditd fields such as pid, uid, auid, ses, UID, and AUID are populated by auditd itself and follow the upstream auditd documentation.
The example entry looks like this in the log and is wrapped here for readability:
type=USER_END msg=audit(1760430391.184:24): pid=5447 uid=0 auid=4294967295 ses=4294967295 msg='op=user-session-timeout acct="admin" exe="web" hostname=? addr=? terminal=d4ec reason= res=success'^]UID="root" AUID="unset"
The fields are interpreted as follows:
| Field | Description | Example |
|---|---|---|
| type | Audit message type | USER_END |
| msg | Audit timestamp and record id (audit(…:…)) |
audit(1760430391.184:24) |
| pid | Process ID of the emitter (rpcd) | 5447 |
| uid | Effective user ID of the emitter | 0 |
| auid | Audit user ID (unset here) | 4294967295 |
| ses | Numeric audit session ID | 4294967295 |
| op | Operation string inside msg='…' |
user-session-timeout |
| acct | Account name inside msg='…' |
admin |
| exe | Source component inside msg='…'. web includes JSON‑RPC; adsdpd is service access |
web |
| hostname | Not used; remains ? |
? |
| addr | Source address. IP for web, MAC for adsdpd | ? |
| terminal | First four characters of the session SHA‑256 hash | d4ec |
| reason | Reason text on errors. Empty on a normal timeout | |
| res | Result of the operation (success or failure) |
success |
| UID | Text copy of uid |
root |
| AUID | Text copy of auid |
unset |
For SIEM or SOC integration, parse the key–value pairs inside the quoted msg='…' section to extract op, acct, exe, addr, terminal, reason, and res. To correlate authentication activity, combine acct (username), terminal (session hash prefix), and exe (method). A normal idle timeout has res=success and an empty reason.
When the event is generated
USER_END is generated when a logged‑in session reaches the configured idle timeout and the rpcd service terminates the session.
The rpcd process calls its destroy() function, which uses audit_log_acct_message() from libaudit to write a USER_END record to audit.log. This applies to both Web UI sessions and JSON‑RPC API sessions; JSON‑RPC sessions appear as method web in the logs.
USER_END is different from USER_LOGOUT, which records a user‑initiated logout. A normal timeout has op=user-session-timeout, a valid acct username, exe=web or exe=adsdpd, and res=success.
Sample audit.log entry
<pre>
type=USER_END msg=audit(1760430391.184:24): pid=5447 uid=0 auid=4294967295 ses=4294967295 msg='op=user-session-timeout acct="admin" exe="web" hostname=? addr=? terminal=d4ec reason= res=success'^]UID="root" AUID="unset"
</pre>