Is there any way to see the past Remote Access User Connections on a Quantum Spark 1550 Appliance?

[CheckMateME]

We are trying to investigate some user activity and need to know who was connected to the VPN and at what times for the past month. Is there some CLI command or log file that we can use to get that information? The Appliance hasn't been rebooted in that time if that makes any difference.

[PhoneBoy]

I presume each connection from a Remote Access user will show in the Security Logs.
I don't think you can access the logs from the CLI on an SMB device.

[G_W_Albrecht]

This is possible but complicated: Use logs from /var/log/log/local/and follow SMB security log files. You need e.g. a SMS in VM with Eval to rebuild the logs and then can export them in readable format using logexport.

Much easier to use Embedded GAiA WebGUI...

[CheckMateME]

Thanks. I took a look at your SMB security log files post but didn't really know what a GAiA SMS VM was. My best guess was Security Management Server and found https://support.checkpoint.com/results/download/124397 but wasn't sure.

If you know an easy way to filter the logs on the Embedded GAiA WebGUI I'd happily use that. The best I have come up with is to scroll down the security logs till all (enough) are loaded and then filter on "vpn" and look at the "User" in the details for every record.

[G_W_Albrecht]

Yes, as i wrote above, easiest way is to filter the security logs in Embedded GAiA WebGUI