topic Re: Global Protect Disable Reason in General Topics

Global Protect Disable Reason

SIDD76 — Wed, 20 Feb 2019 00:32:16 GMT

Global Protect Client is setup so that users can disable VPN however they need to input a reason why they disabled the portal. I wanted to know where those disable reasons are stored.

Thanks

Re: Global Protect Disable Reason

emr_1 — Wed, 20 Feb 2019 04:09:59 GMT

You can find under Monitor tab > Logs > system.

Log format is like below

===

Severity: informational
Event: globalprotectgateway-agent-msg
description: GlobalProtect gateway agent message. Login from: <src IP>, User name: <user name>, Time: 1550635345, Message: Agent Disable, Comment: <reason>. Override(s)=2.

===

I believe <reason> field is what you are looking for.

Re: Global Protect Disable Reason

Raido_Rattameister — Wed, 20 Feb 2019 17:43:36 GMT

Monitor > Logs > System

( description contains 'Message: Agent Disable, Comment: ' )

Re: Global Protect Disable Reason

MP18 — Thu, 12 Dec 2019 06:52:23 GMT

Good to know this.

Re: Global Protect Disable Reason

Njabulo — Fri, 02 Jul 2021 13:44:14 GMT

Hi Guys.

I'm experiencing the same issue however I'm not seeing the reason message typed by the user under the system log, so these logs have also stopped completely on my system logs..I cant see them anymore even if users still type them.

Re: Global Protect Disable Reason

William-Wu — Mon, 25 Apr 2022 18:59:37 GMT

The Disable VPN reason log has moved from the "Monitor tab > Logs > system" to the "Monitor tab > Logs > GlobalProtect" log.
=================
Event:: gateway-agent-msg
=================