I would like to be able to track users logging into an MX appliance via the client vpn. I would like to report on information like how many times a user logins into the appliance (past 30-45 days) how long they have been logged in, etc.. Can I do this?
We've been doing this for years to fulfill a requirement by the HR Department. Our MX is sending logs to a Syslog server. The Syslogs contain unique wording for when a client is connected and disconnected from the VPN:
logtime message 2020-06-21 14:43:26 1592765006.928610814 MY_MX100 events client_vpn_connect user id 'employeeA' local ip 192.168.10.8 connected from 22.214.171.124 2020-06-21 15:16:16 1592766976.058749887 MY_MX100 events client_vpn_disconnect user id 'employeeA' local ip 192.168.10.8 connected from 126.96.36.199
If you can write a script or program to parse that out for you, you can get the username, the local IP, the remote IP and the timestamp. We put all these VPN events into a SQL table to make reporting simple.