Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Monitoring VPN activity

Hello all,

I have couple of IKE/IPSEC VPN client connexions enabled over an ASA 5515 and I would like to log VPN activity (user login name, connection time and duration, ...) like information I can see going to "Monitoring >> VPN >> VPN Statistics >> Sessions.

Thanks for you help

Regards,

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Monitoring VPN activity

You need a reporting process for thie syslog data input.  Personally, I use SPLUNK, but whatever you have, you'll need to look for syslog messages with

"%ASA-4-722051" OR "%ASA-4-113019"

(I'm using ASA 8.4.7).  Messages with those identifiers indicate a login/logout.

5 REPLIES

Re: Monitoring VPN activity

You can use the syslog feature to log.

Sent from Cisco Technical Support iPad App

Community Member

Re: Monitoring VPN activity

Hi Jeff,

Thanks for your answer and sorry to come back so late ...

Could you please tell me more about the process :s ?

Syslog is enabled, a syslog sever catching trap from the ASA. But I don't know what else to do :s

Thanks in advance

Re: Monitoring VPN activity

You need a reporting process for thie syslog data input.  Personally, I use SPLUNK, but whatever you have, you'll need to look for syslog messages with

"%ASA-4-722051" OR "%ASA-4-113019"

(I'm using ASA 8.4.7).  Messages with those identifiers indicate a login/logout.

Community Member

Re: Monitoring VPN activity


Thanks Jeff.

I use Syslog Wacther.

I have looked for "%ASA-4-722051" or "%ASA-4-113019" but I will get 113019 and it reffers to a disconnection ... :/

I will check around for the global list of identifiers ... and let you know

Community Member

Re: Monitoring VPN activity

All right I found a workaround :

I looked for any messages with my username in it.

It gave me the global connection activity from the AAA user authentification 113012 to the disconnection 113019.

Thanks for you help Jeff.

1394
Views
0
Helpful
5
Replies
CreatePlease to create content