Erratic AnyConnect Connections in Syslog

[haggittmark@tm-america.com]

I am using syslog to track when users connect in and out of AnyConnect. Message id 722022 tells me when the connection is established and connection message 722023 tells me when the connection terminates. The syslog’s seem to give decent report, especially yesterday. However, today I have a few people showing as logging in and out 3-4 times in a matter of 5 minutes. I don’t know what is going on here? Any ideas?

[marce1000]

 - Why do you determine this as erratic, meaning could it be related to user-activity (only) ?

  M.

[haggittmark@tm-america.com]

no. The timing of the syslog messages isn't logic.  It doesn't seem likely that someone would log in and out of VPN ever 15 minutes.  does that help?

Attached is a picture.

[marce1000]

 - Perhaps, unless the user's device has some resource hick up or an erroneous app (e.g) which makes Anyconnect disconnect and re-connect at regular intervals.

 M.

[haggittmark@tm-america.com · Accepted solution]

We decided to go with the code that shows the duration.  113019