Hello together,
I probe to get the active session count from our asa logs per minute.
I created a datamodel (CASA) which contains the username and also the session_duration field if the session is closed.
A session can only timeout after 15 minutes, if no packet arrives by the vpn gateway.
Also, a session can be active over years, so the correlation from session start and logout events are not possible.
Actually i had this:
| tstats
estdc(ASA.Username) as UsrC
count(ASA.session_duration) as LogC
from datamodel=CASA where (nodename = ASA.VPN)
groupby _time, host
prestats=false span=15m | eval "Active Sessions"=UsrC - LogC
time | host | UsrC | LogC | Active Sessions
23:00 | vpnhost1 | 103 | 15 | 88
23:15 | vpnhost1 | 99 | 15 | 84
23:30 | vpnhost1 | 85 | 11 | 74
23:45 | vpnhost1 | 82 | 11 | 71
I think the solution would be that every minute he count and dedup the field ASA.Username for the last 15 minutes.
But actually, I have no idea to solve this.
Did anyone have a solution to my problem or need additional information to help?
