I am using syslog to track when users connect in and out of AnyConnect. Message id 722022 tells me when the connection is established and connection message 722023 tells me when the connection terminates. The syslog’s seem to give decent report, especially yesterday. However, today I have a few people showing as logging in and out 3-4 times in a matter of 5 minutes. I don’t know what is going on here? Any ideas? I am using "logging trap vpnlist". 5 min is an exaggeration. the frequency is more like 15-30 min.
