Accessing logs after user deletion in Ezeelogin

Overview: This article explains how admin privileged users can still access and retrieve logs in Ezeelogin after a user has been deleted. This can be done by using alternative search parameters in the web panel or by directly accessing raw log files on the SSH jump host, as long as SSH log encryption was not enabled when the logs were recorded.

When a user is deleted from Ezeelogin, their logs are preserved for audit and security purposes. Although the username may no longer be directly searchable in the web panel, you can still access these logs by searching with alternative parameters like the server hostname and date range.

Alternatively, you can find the raw logs on your SSH Jumphost box

You can read the logs as plain text provided the SSH log encryption was not enabled at the time the SSH log was recorded.

Related Articles:

View logs of all users.

Decrypt the encrypted SSH logs.