VPN 3005 concentrator login history

[jlandis]

I was asked for some login history for a certain individual, but cannot locate a place it may be found on the concentrator. There is a place to view recent sessions, but other than that our Radius server would be the only other place I can think of to look for login history.

Is anyone aware of a login history file on a 3005 concentrator?

[gfullage]

Logins are stored in the standard event log file on the 3000. You'll get log messages of the form:

239 11/06/2003 10:23:45.950 SEV=5 AUTH/36 RPT=5 64.104.224.194

User [ admin ] Protocol [ HTTP ] attempted ADMIN logon..

Status: !

241 11/06/2003 10:23:45.950 SEV=4 AUTH/83 RPT=5

User [admin] connected

242 11/06/2003 10:23:45.950 SEV=4 HTTP/47 RPT=5 64.104.224.194

New administrator login: admin.

This is under Monitoring - Filterable Event Log. This event log is automatically overwritten when it gets to a certain size, so if you want to keep old versions of it for tracking, then go under Config - System - Events - General and FTP Backup and set it up so that'll automatically FTP a copy of the log file to an FTP server whenever it fills up. This way you'll have records going back as long as you want.

[jlandis]

Thanks for the reply. I'll go there and set it up.