View Historic Logs for SSL VPN on FortiAnalyzer 200F

[ForgetItNet]

Hi all,

I've inherited a network with a 200F Analyzer and so i've not used one of these before but i'm trying to find a log that will show me connect and disconnect times for the past month or two for a certain user ? Where is the best place to look for this as i can find the EVENT-VPN but there's too much data in there and if i choose the USER log then i can't see this user in the list at all ? They log in via the FortiClient VPN program with SSL connections using LDAP creds by the way.

Any help would be great.

Thanks

[Anthony_E]

Hello ForgetItNet,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

We are still looking for an answer to your question.

Could you please indicate under which version your FortiAnalyzer is running?

Regards,

[Debbie_FTNT]

Hey ForgetitNet,

I would suggest you check the VPN event logs on FortiAnalyzer and filter for the following:
- user: <>

- exclude tunnel-stats
-> once you filter for the user, you should get a display of relevant VPN logs for that one, and you can right-click on particular values in particular columns (like tunnel-stats) and select to filter or exclude those
With those two filters in place, you should see a display  of when the user connected and disconnected from VPN.