Tracing iPhone/iOS AnyConnect On-Demand?

[cmonks119]

We have AnyConnect On-Demand implemented for iPhones/iPads. It works good when needed, however we also notice that it connects on it's own from time to time, with no apparent request for VPN services. We have included/excluded domains setup. 

Does anyone know how to figure out WHAT resource is being requested to kick off the VPN? Debug logs in AnyConnect don't seem to have any information other than 'user requested vpn resource'. If we could figure out what that resource was, we could either stop it or exclude it.

Thanks 

[Shinpei Kono · Accepted solution]

iOS console log will show what app kicks off VPN because on-demand is a feature provided by iOS. It will look like the snippet in the picture below. The output indicates AnyConnect is triggered by Jabber application.

iOS console log was previously available in iPhone Configuration Utility but you may need to find a third-party application to generate the log.

[Andres Villarroel]

Thanks for the information shkono,

What 3rd party software would you recomend or what kind of program should we look for?

[cmonks119]

I found an iPhone app in the app store called 'system console' that shows the iOS console on the device. Looks like it does show the on-demand event and the process and hostname that kicked it off.