Dashboards & Visualizations

VPN Concentrator 3000

fasteddye
Engager

I am new to Syslog and Splunk. We are trying to be able to track users logging into the VPN Concentrator 3000. We have a syslog server setup and I just recently installed Splunk. I am looking for some guidance on how I could setup a report or dashboard to show user login history.

Tags (3)

dwaddle
SplunkTrust
SplunkTrust

There may already be "an app for that", check http://splunkbase.splunk.com/ to see.

If not, then the first thing you'll want to do is come up with a series of searches that describe the conditions you're interested in. I'm not a VPN 3000 user (ASAs instead), so I really don't know what searches would be right for this situation.

Once you have the searches figured out, then you can start making saved searches out of them, which will allow you to use them in "Simple XML" dashboards. A relevant doc topic would be http://www.splunk.com/base/Documentation/latest/Developer/Step1CreateADashboard.

One thing to consider is that the VPN3000 logs may not be your "best" source of data for this type of event. For example, we get much higher fidelity data from our RADIUS server's accounting logs. Our ASA sends an "start session" accounting event followed by an "end session" accounting event to our RADIUS server, and those are much easier to deal with. If you're using RADIUS, this may be a good choice. (My opinion is that it would be worth configuring a RADIUS server just for the accounting, even if you don't use it for authentication and authorization)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...