Hide this message
Welcome to the NEW Success Center. Search all resources (documentation, videos, training, knowledge base articles) or browse resources by product. If you are unable to find what you are looking for, please contact us at firstname.lastname@example.org
This article provides information on how to monitor Logon and Logoff activity through a Cisco ASA firewall.
All versions of LEM
For a list of all Cisco syslogs please see: http://www.cisco.com/c/en/us/td/docs...s/logsevp.html
According to the document above, theProviderSID for Logon is ASA-6-113004
Search in nDepth
ndepth Search = AnyAlert.ProviderSID = *113004*
LEM translates the following syslog as aUserLogon...
%ASA-6-113004: AAA user aaa_type Successful: server = server_IP_address, User = user
LEM translates the following as aUserLogoff
%ASA-6-113013: AAA unable to complete the request Error: reason = reason: user = user