Avatar of PerimeterIT
PerimeterIT
 asked on

ASA VPN SYSLOG events

I'm generate to generate a report from our ASA SYSLOGs to find out how often our users have been logging in with there VPN client.

We have been recording the SYSLOGs from our ASA 5510 for months now but we are having difficulty sorting through it to generate a suitable report.

What I would like is a report that tells me when users authenticated to the firewall with there VPN client and when they disconnected,I would also like a similar report for the SSL VPN.

But the catch is I have no idea what SYSLOG events I should be looking for as I'm literally sorting through millions of events.

Does anyone know these events off hand?

Once I get that I can just setup the report filtering in our tool.
RoutersVPNCisco

Avatar of undefined
Last Comment
Justin Ellenbecker

8/22/2022 - Mon
Justin Ellenbecker

ASA-5-722037: Group <My Group> User <My User> IP <My IP> SVC closing connection: User Requested.

Is a common connection string for a user.  There should also be an open i am looking for the standard for SSL but should be similar, look for when the username is passed.
ASKER CERTIFIED SOLUTION
Justin Ellenbecker

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23