Exam F5CAB4 Topic 5 Question 43 Discussion

On BIG-IP systems, all authentication attempts for administrative access-including logins to the Configuration Utility (GUI)-are logged in /var/log/secure. This log file records:
* Successful and failed login attempts
* The username used
* The authentication method (local, LDAP, RADIUS, etc.)
* Access denials and PAM authentication errors
Why the other options are incorrect:
* /var/log/pam/tallylog tracks account lockouts and failed attempt counters, not detailed login attempts.
* /var/log/ltm logs traffic management events, not administrative authentication.
* /var/log/httpd logs web server activity but does not record authentication success or failure for BIG-IP administrative users.
Therefore, the correct log file to verify whether a user attempted to log in to the BIG-IP Configuration Utility is /var/log/secure.