Cisco VPN Client syslog to user-id agent

[nextgenhappines]

Hi,

We are trying to have Cisco ASA VPN server to send syslog message to kiwi syslog server.  The kiwi syslog server uses the vbscript to feed vpn username and vpn assigned ip address to user-id agents.  The cisco vpn client log-off message does not contain the vpn assigned ip address.  Anyone solve this problem before?

Thanks,

Ernest

[nitrotc]

Use debugging level ASA log message 746012 and 746013.  746013 has the logoff information you are looking for.

If you don't want to up the logging level to debugging you can do something like this on your ASA

Logging list MY_VPN_MESSAGES level 5

Logging list MY_VPN_MESSAGES message 746012-746013

Logging trap MY_VPN_MESSAGES

[MydisplayNameis3]

Has anyone gotten Cisco ASA vpn users to PAN USER-ID via syslog  WITHOUT Kiwi syslog server? (aka $299)

[nitrotc]

Sure.  We also have this working with syslog-ng on a free Linux distro like CentOS.

Just call your script from syslog-ng.conf:

destination d_asa_to_userid { program("/etc/scripts/asa2uid.pl"); };