SSL-Tunnel VPN User Report

Forum|Forum|7 years ago
August 17, 2018
6 replies
23751 views

Hi All,

I need a granular report that shows logon times and logoff times for the SSL VPN Users.

The datasets I have been trying dont seem to be the most recent. Ideally I would like a report showing when users logged in, for how long and when they logged off and from which IP.

The standard report only seems to be providing me with two days data as the cache is sitting at 100% for that report, not sure if this will impact my duration of history for the report?

Best answer by jpalmer99

Not all of us have access to that site. Would it be possible to post information here? Thank you.

chall_FTNT

Staff

Logview >> Chart Builder won't include all the fields you are looking for.

Either use multiple predefined datasets or combine them into a customized one.

Predefined dataset: vpn-User-Login-history ... group by timestamp, devid, vd, remip, tunnelid

(has timestamp but not user or duration)

Predefined dataset: vpn-Top-Dial-Up-VPN-Users-By-Duration

... group by devid, vd, remip, t_type, tunnelid) tt where bandwidth>0 group by user_src, tunneltype order by duration desc

AtiT

New Member

Hello,

maybe something like this?

SELECT `user` AS vpn_user, `remip` AS peerip, `duration` AS vpn_dur, FROM_ITIME(`itime`-`duration`) AS start_time, FROM_ITIME(`itime`) AS end_time, `tunneltype` AS vpn_type FROM $log WHERE $filter AND `subtype`='vpn' AND `tunneltype` IN ('ssl-tunnel','ssl-web') AND `action` = 'tunnel-down' AND COALESCE(NULLIFNA(`user`), IPSTR(`remip`)) IS NOT NULL AND `tunnelid` IS NOT NULL GROUP BY vpn_user, peerip, vpn_dur, start_time, end_time, vpn_type

chall_FTNT

Staff

I think the WHERE condition `action` = 'tunnel-down' will be too restrictive. And usually there is an "Order by".

Otherwise, in theory, that looks okay.

Sign up

Login with SSO

Login to the community

Login with SSO