Question Log for admin password changes through terminal

[dileep86]

Hi all,

My plesk admin password was suddenly changed without me knowing.
I logged in to terminal and reset the password.
However, I'd like to know when the password was changed.

I went through the action logs and there is no mention of a password change which was done through the terminal.
The action log shows failed password attempts but there is not mention of a password update.

Is there any other place that holds all Plesk terminal commands entered that I could look for?

I had a look at the ~/.bash_history was nothing there.

Many thanks in advance.

 

[IgorG]

Try changing your password again and notice the associated entries in /var/log/plesk/panel.log
After that, look for the similar previous records in this log.

 

[dileep86]

Try changing your password again and notice the associated entries in /var/log/plesk/panel.log
After that, look for the similar previous records in this log.

Sorry all I have is the below relevant to the time the password was reset through the terminal.
I'm afraid it has nothing about a password change.

[2020-11-06 11:15:37.845] ERR [panel] [Action Log] Failed login attempt with login 'admin' from IP xxx.xxx.xxx.xxx
[2020-11-06 11:15:39.977] ERR [panel.ui] You have entered incorrect username or password.
[2020-11-06 11:16:37.992] ERR [panel.ui] The administrator&#039;s password cannot be sent by email for security reasons.<br />
To log in as &#039;admin&#039;, use the &#039;plesk login&#039; command. To set a new &#039;admin&#039; password, use the &#039;plesk bin admin --set-password -passwd &lt;new_password&gt;&#039; command.

Action log only shows failed attempts and login successful notices.
Terminal password reset and password changes from Plesk admin panel is not shown.
The action log has the "Administrator Information Update" checkbox checked as well.

This probably is a feature that needs to be added on to Plesk.

Any idea of any other places I could look for?