Monitoring applications and data volume related to remote access sessions

[Peter_Elmer]

Following up the great work of @Tomas_Vobruba mentioning the importance of SmartView Remote Access support, I created the attached View. 

It shows the how long the user was connected, which application she/he has accessed and that data volume transmitted.  Check the video to learn more how you can use this view.

[Jacopo_Vigano]

Hi Peter,

are there any method to have a timeline with concurrent active users?

From your template we are able to see the timeline with login peak, but customer asking a timeline with concurrent users.

Thanks in advance.

Jacopo 

[Paul_Kellett · Accepted solution]

Have a look over on this page too for some more details in reporting for VPN : https://community.checkpoint.com/t5/Visibility-Analytics/SmartView-VPN-Client-enhanced-view/m-p/7887...

Designed to provide 

- total time spend on VPN

- transferred total bytes.

- number of logs

- blade used

- client used for connection (workspace, endpoint, snx, etc)

- login fails and realauth schemes

[Jacopo_Vigano]

I already reviewed the link you posted, but there are no any references regarding concurrent users.

Talking with a TAC Engineer, he told me that it seems there are not any method to get concurrent users from SmartEvent. It seems that this information is only available on the Gateway.

Thanks.

Jacopo

[Maarten_Sjouw]

That is indeed the information I also got from R&D when I was trying to get the user numbers on an MDS per domain.

[Juan_]

Hi Peter,

Have tried this in lab and worked well.

However, integrating it in production (200+ RA users), hence, more users and log data causes the cpu to max out and ultimately to SmartLog/SmartEvent to fail. 

Only recovering it with a evstop ; evstart, or waiting many hours.

This might probably be the reason: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Do you know of any successful use cases in production environments?

In which case i may raise a SR to tac to see if there is something else going on with my Management.

[nasa]

There is a SmartEvent License needed to use this feature, right ?

[PhoneBoy]

Yes, these reports require a SmartEvent license.

[marciojss_check]

My dash is with  transferred total bytes in O, Can you help me?

[pavan_kalal]

How to create his custom report ? can anyone explain in details R80.30.

[PhoneBoy]

The report was attached to Peter’s original post and can be imported into R80.30.

[mbckymber]

Hi Peter , Can u tell me why if when implement this solution , i have the cpu 100%?

[Peter_Elmer]

Hi,

you may want to work with Secure Knowledge and TAC here, as high CPU load can have many reasons. You may want to get started with sk167553 and sk165853.

-pelmer