is there a report or log that can be viewed that shows when a user enters their PIN to receive their on-demand token?

[JohnMcKellep]

We are having issue where people are not receiving their on-demand token after entering their PIN. We are trying to prove that the issue is with our mail delivery system and not with the RSA. Is there somewhere on the RSA console where i can view logs that show PIN activity?

[HassanMehsen]

You can simply take a tcpdump using the authentication manager CLI matching the SMS gateway IP address as the host to filter on.

[JayGuillette]

If not sure of SMS gateway IP address, or proxies or load balancers are involved, filter the TCP dump on TCP port 25.  Write it to a file to go through it with WireShark

am81p:~ # cd /usr/sbin
am81p:/usr/sbin # ./tcpdump -i eth0 -s 1514 -Z root port 25 -w /tmp/smtp_<server_name>.pcap

See 000029925 - How to troubleshoot On-Demand Authentication (ODA) login failures in RSA Authentication Manager 8.1