Skip to main content
ForgetItNet
ForgetItNet
Explorer II
July 27, 2022
Question

View Historic Logs for SSL VPN on FortiAnalyzer 200F

  • July 27, 2022
  • 3 replies
  • 6978 views

Hi all,

 

I've inherited a network with a 200F Analyzer and so i've not used one of these before but i'm trying to find a log that will show me connect and disconnect times for the past month or two for a certain user ? Where is the best place to look for this as i can find the EVENT-VPN but there's too much data in there and if i choose the USER log then i can't see this user in the list at all ? They log in via the FortiClient VPN program with SSL connections using LDAP creds by the way.

Any help would be great.

Thanks

3 replies

Anthony_E
Staff
Anthony_E
Staff
July 31, 2022

Hello ForgetItNet,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Best Regards
Anthony_E
Staff
Anthony_E
Staff
August 4, 2022

Hello,

 

We are still looking for an answer to your question.

Could you please indicate under which version your FortiAnalyzer is running?

 

Regards,

Best Regards
Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
August 4, 2022

Hey ForgetitNet,

I would suggest you check the VPN event logs on FortiAnalyzer and filter for the following:
- user: <>

- exclude tunnel-stats
-> once you filter for the user, you should get a display of relevant VPN logs for that one, and you can right-click on particular values in particular columns (like tunnel-stats) and select to filter or exclude those
With those two filters in place, you should see a display  of when the user connected and disconnected from VPN.

Terms & ConditionsAccessibility statement