FAZ 200F SSL VPN login fail report

[Navs1818]

Hi all

I am trying to setup a report on our FAZ 200F running 7.0.12 to monitor the number of failed VPN login attempts. I can see failed ssl login attempts for today under log view > Event > all types and using the filter action="ssl-login-fail"

However, when i create a report for today using the action filter i get no matches. I have tried running the report using the filter Action(action) equals ssl-login-fail and also Action (act) equals ssl-login-fail but get empty reports.

My long term aim is to get a list of failed ssl vpn logins for yesterday emailed to me so i can monitor the list, and also a chart would be nice too of the last 7 days failed SSL VPN logins.

Any help appreciated.

[awadhm1]

Unless I'm grossly mistaken; diag debug commands only help if I'm actively debugging something. I'm looking for recorded historical failures when someone isn't actively staring at a screen of debug data https://mobdro.bio/ .

[vraev]

Hi @Navs1818 ,

Please review these articles:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-a-VPN-report-for-users-c...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-monitor-the-remote-VPN-users-wo...