Monitor username for VPN connections through ASA 5510

[marybethlampe]

We want to track username, login and logout times for VPN connections through ASA 5510. Is there a way to receive an email notification for those or get that information from a SYSLOG server?

[guibarati]

Yes, its already logged in ASDM realtime log.

What you have to do is:

-Open ASDM realtime log

-Connect a vpn

-Look and record the number of the event that appears on "Syslog ID" Column. (There is one for VPN Phase 2 complete(connection) and one for the disconnection)

-If you want it to be sent by email go to:

ASDM---> Logging ---> SMTP

Put here the address of your SMTP server (it should allow relay from ASA)

ASDM---> Logging ---> E-mail Setup

Put the informations (email source and destinations)

ASDM---> Logging ---> Logging filter

Create a filter that send to the email only the events with the Two syslog ID you have seen in the realtime log.

Rate if helpfull

[srue]

or from a command line:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/monitor.html#wp1064823