VPN User reports - help needed with outputs

[Ants]

Hi All,

So I have  VPN reports scheduled in R80.10 running and outputs VPN user activity for the previous day.

Report itself is simple in that it logs the following criteria

Time, Origin, Action, source, User, Client Name, Reason

Main goal for this is to view user login / logout times if needed..

So this works fine.. but I need to understand the difference between a 'session timeout' and 'user has signed off' - itself not an issue.. but it is sometimes logged against different actions which is a bit confusing..

see example below for user 'asmith'  - can anyone help me understand the difference in

action = 'update' with reason 'user has signed off'

vs

action = 'log out' with reason 'Session timeout'

I would expect these reasons to be the other way round..

Any ideas

thanks in adv

Sep 2, 2019 10:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 11:08:41 PM	FW01	Log Out	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 11:08:41 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 3:05:35 PM	FW01	Log In	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)	Endpoint Security VPN
Sep 2, 2019 3:08:42 PM	FW01	Log In	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)	Endpoint Security VPN
Sep 2, 2019 3:50:14 PM	FW01	Log In	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)	Endpoint Security VPN
Sep 2, 2019 3:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		User has signed off
Sep 2, 2019 3:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 4:48:15 PM	FW01	Log Out	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		User has signed off
Sep 2, 2019 4:49:13 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		User has signed off
Sep 2, 2019 4:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 5:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 6:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 7:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 8:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout
Sep 2, 2019 9:59:59 PM	FW01	Update	111-111-111-111.mobile.net (111.111.111.111)	Auser Smith (asmith)		Session timeout

[G_W_Albrecht]

Session timeout here is the IKE over TCP timeout (there is also a UTP timeout). So if a connection is not used for a time (1 hour usually), we have a session timeout followed by an implicit logout.