We do have login time, using that and the IP to correlate that with the access 
logs. Not all login entries have corresponding POST entries in access log, so 
those would be our problems occurrences.
They actual correspond to a GET entry from a user.

IP of the GET request of User1 matches with the login record in the database 
(login would be for User2 id and IP from User1 GET). So it looks as if the same 
user logged in from two different IPs
around the same time, which shouldn't be the case.

Thanks,
Prasanth

On 03/15/2018 10:28 AM, Yasser Zamani wrote:
>
> On 3/15/2018 5:21 PM, Prasanth Pasala wrote:
>> User2 would have logged in some time before that, some times with in a 
>> minute before that. I haven't seen any requests from User2 exactly at the 
>> time of GET request from User1.
> It's strange :)
>
> Are login log records have same field values for both User1 and User2?
> Do you also have login time in there? If so, are they same and are they
> consistent with access log times? Are their IP same (while they
> shouldn't, right?)? Is the IP of the GET request of User1 (that is
> logged in access log by container) same as the IP field value of your
> login log records?
>
> Thanks!
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
> For additional commands, e-mail: user-h...@struts.apache.org
>

Reply via email to