Global Protect Disable Reason

cancel
Showing results for 
Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Global Protect Disable Reason

L0 Member

Global Protect Client is setup so that users can disable VPN however they need to input a reason why they disabled the portal. I wanted to know where those disable reasons are stored.

 

Thanks 

1 ACCEPTED SOLUTION

Accepted Solutions

L5 Sessionator

You can find under Monitor tab > Logs > system.

Log format is like below

===

Severity: informational
Event: globalprotectgateway-agent-msg
description: GlobalProtect gateway agent message. Login from: <src IP>, User name: <user name>, Time: 1550635345, Message: Agent Disable, Comment: <reason>. Override(s)=2.

===

 

I believe <reason> field is what you are looking for.

 

View solution in original post

5 REPLIES 5

L5 Sessionator

You can find under Monitor tab > Logs > system.

Log format is like below

===

Severity: informational
Event: globalprotectgateway-agent-msg
description: GlobalProtect gateway agent message. Login from: <src IP>, User name: <user name>, Time: 1550635345, Message: Agent Disable, Comment: <reason>. Override(s)=2.

===

 

I believe <reason> field is what you are looking for.

 

Monitor > Logs > System

 

( description contains 'Message: Agent Disable, Comment: ' )

Enterprise Architect, Security @ Cloud Carib Ltd
ACE, PCNSE, PCNSI

Good to know this.

MP

Hi Guys.

I'm experiencing the same issue however I'm not seeing the reason message typed by the user under the system log, so these logs have also stopped completely on my system logs..I cant see them anymore even if users still type them.

ND Radebe

L1 Bithead

The Disable VPN reason log has moved from the "Monitor tab > Logs > system" to the "Monitor tab > Logs > GlobalProtect" log.
=================
Event:: gateway-agent-msg
=================

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!