Login History for specific extension

[motivit.admin]

Can you please tell me where can I find the login history of an extension to the webclient console which includes the user’s IP? One of our extension got compromised and we wanted to know where is the source IP came. I tried to check the web management console reporting and can’t find the information I need.

Our 3cx is hosted in DigitalOcean cloud using the latest update of version 16.

Thank you,
Alfie

 

[technigogo]

Hi Alfie,

Version 18 has Auditing which would make this task a breeze. However, version 16 did not. Version 16 is also EOL as of November 30, 2022.

 

[motivit.admin]

Hi Alfie,

Version 18 has Auditing which would make this task a breeze. However, version 16 did not. Version 16 is also EOL as of November 30, 2022.

sorry I was wrong. We are using version 18.0 (Build 418). I tried to filter the Login History of the agent in the Audit log but nothing shows up. Can you tell where can filter the extension login that includes its IP?

 

[OlegOLP]

Unfortunately, this is not possible. Since the real IP address is not visible due to the tunnel

{
"count": 1,
"devices": [
{
"userAgent": "3CX Mobile Client",
"contact": "sip:[email protected]:5483;rinstance=403b346f061c23e9"
}
]
}

the same with WebRTC

 

[motivit.admin]

Unfortunately, this is not possible. Since the real IP address is not visible due to the tunnel

{
"count": 1,
"devices": [
{
"userAgent": "3CX Mobile Client",
"contact": "sip:[email protected]:5483;rinstance=403b346f061c23e9"
}
]
}

the same with WebRTC

@OlegOLP
Thanks for confirming. That's what I thought too and wanted to double check with others as maybe they have some other ways to see it cause what I can only see when enabling the Verbose logging, it can only capture those invalid attempts/registration where IPs got blocked.