> Source: [sk181344](https://support.checkpoint.com/results/sk/sk181344)

# sk181344 - API commands that a non-local Gaia user runs are logged in the /var/log/messages file as if the "admin" user ran them

| Property | Value |
|----------|-------|
| Solution ID | sk181344 |
| Date Created | 2023-08-01 |
| Last Modified | 2023-12-03 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.20 |
| OS | Gaia |

## Symptoms

- API commands that a non-local Gaia user (authenticated on a TACACS or RADIUS) runs are logged in the */var/log/messages* file as if the "admin" user ran them.

Example (truncated):

1. Log in to Gaia API

   `[Expert@MyGW:0]# gaia_api login --version 1.7 --format text`  
   `
   b'api-server-version: "1.7"\nread-only: "false"\nsession-timeout: "600"\nsid: "983...839"\nurl: "https://127.0.0.1:443/gaia_api/v1.7"'`
2. Run a Gaia API command as a non-local Gaia user:

   `[Expert@MyGW:0]# mgmt_cli show-dns --context gaia_api -u XXX -p XXX`  
   `
   primary: 192.168.11.41`  
   `
   secondary: 192.168.11.42`  
   `
   tertiary: 192.168.11.43`
3. The */var/log/messages* file contains this line:

   `Oct 27 15:13:24 2022 ` MyGW clish[230141]: cmd by **admin**: Start executing : show dns (cmd md5: dde...571)

## Cause

Gaia API runs under admin user because some API queries require admin permissions in their logic/code.

## Solution

No fix is required. This behavior is by design.  

To monitor Gaia API, review the *$FWDIR/log/api.elg* file and not */var/log/messages.*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content