Please note, the entry below is a message indicating Artifactory’s frontend service (jffe@000) authenticating with Artifactory which doesn’t help us in this use case and may cause clutter.
2023-05-31T20:54:51.545Z [85cb207a29523cb ] [ACCEPTED LOGIN] for client : jffe@000 / 127.0.0.1. [token]
To filter these messages out, we may add an additional grep to the previous command:
cat artifactory-access.log | grep "\\[ACCEPTED LOGIN\\].*\\[token\\]$" | grep -wv jffe@000
In the event we are working with Docker, it may be less clear who is using a token to log in as Artifactory will record a Docker login as a token login. The Docker client requires a token to authenticate and there currently is no method to disable this behavior within the Docker client.
To distinguish whether a token was used by the Docker client, we will want to cross reference the Trace ID of a login record between the artifactory-access.log and the artifactory-request.log.
1. Perform a docker login
user@user-vm:/opt/jfrog/artifactory/var/log$ sudo docker login artprod.mycompany Login Succeeded
2. In the artifactory-access.log, search for the record indicating a login by the user from step #1 and find the associated Trace ID. As you can see, it looks almost identical to a standard token login made by a user
2023-03-06T18:27:34.862Z [ece32161da11923b] [ACCEPTED LOGIN] for client : admin / 127.0.0.1. 2023-03-06T18:27:35.083Z [ed46478126efb39c] [ACCEPTED LOGIN] for client : admin / 127.0.0.1. [token]
3. In the artifactory-request.log, search for the Trace ID
4. After finding the record with the corresponding Trace ID, we can see that the Docker client made a GET request for a token from Artifactory and received a 200 response, further indicating a login from the Docker client via Access Token
2023-03-06T18:27:34.863Z|ece32161da11923b|127.0.0.1|admin|GET|/api/docker/docker/v2/token|200|-1|0|469|docker/23.0.1 go/go1.19.5 git-commit/bc3805a kernel/5.15.0-1030-gcp os/linux arch/amd64 UpstreamClient(Docker-Client/23.0.1 \(linux\)) 2023-03-06T18:27:35.083Z|ed46478126efb39c|127.0.0.1|admin|GET|/api/docker/docker/v2/|200|-1|0|213|docker/23.0.1 go/go1.19.5 git-commit/bc3805a kernel/5.15.0-1030-gcp os/linux arch/amd64 UpstreamClient(Docker-Client/23.0.1 \(linux\))