Global Protect Disable Reason

[SIDD76]

Global Protect Client is setup so that users can disable VPN however they need to input a reason why they disabled the portal. I wanted to know where those disable reasons are stored.

Thanks 

[emr_1 · Accepted solution]

You can find under Monitor tab > Logs > system.

Log format is like below

===

Severity: informational
Event: globalprotectgateway-agent-msg
description: GlobalProtect gateway agent message. Login from: <src IP>, User name: <user name>, Time: 1550635345, Message: Agent Disable, Comment: <reason>. Override(s)=2.

===

I believe <reason> field is what you are looking for.

[Raido_Rattameister]

Monitor > Logs > System

( description contains 'Message: Agent Disable, Comment: ' )

[MP18]

Good to know this.

[Njabulo]

Hi Guys.

I'm experiencing the same issue however I'm not seeing the reason message typed by the user under the system log, so these logs have also stopped completely on my system logs..I cant see them anymore even if users still type them.

[William-Wu]

The Disable VPN reason log has moved from the "Monitor tab > Logs > system" to the "Monitor tab > Logs > GlobalProtect" log.
=================
Event:: gateway-agent-msg
=================