For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/features/audits/activities/login-logs.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Login Logs

    Login Logs records every sign-in attempt to JumpServer, successful or failed. Use it to confirm who signed in, from where, with which method, and why an attempt failed.

    Open the page from Audits > Activities > Login Logs.

    Overview

    Each row shows the username, authentication method, login city, reason description, status, and login date. Failed rows include the reason, which makes this page the first place to check when users report that they cannot sign in.

    The toolbar provides search, a date range, column settings, export, and refresh.

    Prerequisites

    • Sign in with an account that has the audits.view_userloginlog permission, such as a system administrator or auditor.
    • Users must have attempted to sign in at least once.

    Investigate sign-ins

    1

    Set the date range to the period you want to review.

    2

    Search for a username or filter the list with the toolbar.

    3

    Read the Status and Reason description columns to separate successful sign-ins from failed attempts.

    4

    If a web session needs to be closed, continue in Online Devices.

    Figure 1: Login Logs with username, authentication method, login city, reason, status, and login date.

    Customize columns and export

    Open List preferences, select the columns to display, and click Confirm. Extra columns include ID, type, login IP, user agent, MFA, and reason. Restore defaults returns to the standard set.

    Figure 2: List preferences for login logs.

    Click Export, choose CSV or Excel, select Export all, Export selected, or Export search results, and click Confirm.

    Field reference

    FieldDescription
    UsernameAccount name used for the sign-in attempt.
    Authentication methodMethod used to authenticate, for example password, LDAP/AD, or an SSO provider.
    Login cityCity resolved from the login address.
    Reason descriptionExplanation for a failed sign-in; empty for successful ones.
    StatusWhether the attempt succeeded or failed.
    Login dateWhen the attempt happened.
    TypeOptional. Login source, such as web or terminal.
    Login IPOptional. Source address of the attempt.
    MFAOptional. MFA method used.
    User agentOptional. Browser and operating system.

    Notes

    Tip

    A burst of failed attempts from one address or against one account is a useful early warning. Export the filtered rows and include them in your security review.