How to setup notifications on AnyConnect connects and disconnects

[dougdegraaf]

How do you setup notifications from the ASA when a user connects/disconnects?  I have reviewed a few online forums that attempt to set this up however we are getting way too much sent in the alerts.  We only want the connects/disconnects to be notified.  Can the ASA also include the user account and source IP that are being used at the time of the connection?  Suggestions?

[Bogdan Nita]

You could use a looging list in order to send the messages you are interested in.
For instance you could use %ASA-4-722051 to see a user connected and %ASA-4-113019 when a user disconnected.

%ASA-6-722051: Group group-policy User username IP public-ip Address assigned-ip assigned to session
%PIX|ASA-auth-4-113019: Group = group, Username = username, IP = peer_address, Session disconnected. Session Type: type, Duration: duration, Bytes xmt: count, Bytes rcv: count, Reason: reason

https://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html

logging list anyconnect_messages message 113019
logging list anyconnect_messages message 722051
logging trap anyconnect_messages

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html

HTH

Bogdan