topic Re: collecting end RA user activity in SASE and Remote Access

collecting end RA user activity

marcinw — Mon, 16 Jan 2023 09:34:20 GMT

I was asked to check if it is possible to collect information regarding end user remote access for the last a few months precisely when the user was connected with RA vpn client (days, hours). We don't have Smart Event license so I believe it may be hard

thanks

Re: collecting end RA user activity

Chris_Atkinson — Mon, 16 Jan 2023 10:56:53 GMT

The login & logout logs for VPN connections should be available for you to export/filter as a minimum. Do you know how to see those as-is?

Re: collecting end RA user activity

PhoneBoy — Mon, 16 Jan 2023 22:12:59 GMT

For a specific user or all users?
In general, this data is hard to obtain as the only thing we can reliably get is the user login action.
Logouts aren't always explicit (sometimes they are timeouts).
For a specific user, you might be able to search on the logs that user generated.