Secure Mobile Access 12.4 Administration Guide
Table of Contents
Network Tunnel Audit Log
The network tunnel audit log provides detailed information about connection activity, including the status of completed tunnel connections and the status of completed flows within tunnels.
The two record types can be distinguished by the word flow or tunnel appearing in the sixth
field of the message.
Messages are stored on disk in the file /var/log/aventail/extranet_access.log and contain these
parameters:
[source-ip:port] [authentication] "[username@realm]" "[date/time]" [version] [command]
[destination-ip:port] [status code] [bytes-received] [bytes-sent] [connection duration] [imei]
This example illustrates a network tunnel service audit log file entry:
12.230.158.210:1110 ssl:LDAP "fred figment" "13/Sep/2016:19:18:28 -0700" v1.1 flow:tcp
192.168.136.254:22 0 21722 60631 263 490236207159217
The log entries contain the fields (separated by spaces) shown in the Network tunnel audit log fields table.
| Field | Description |
source-ip:port
|
For tunnel records this field contains the source address of the outer tunnel connection. For flows this field contains the inner flow source address, which is the virtual IP address assigned from a tunnel pool when the tunnel is established. Example: |
authentication
|
A hyphen (-) indicates re-authentication via TEAM credential. An explicit value is not possible, because the tunnel does not know the authentication method used to negotiate the TEAM credential. |
"username@realm"
|
User accessing the resource, and the realm he or she is logged in to. The format of this field varies, depending on the authentication method used. Example: " |
"date/time"
|
Date (in date/month/year format) and time (hours, minutes, seconds, and milliseconds in 24-hour-clock format and hours of time zone +/- GMT) the connection began. Records containing date/time may not be written immediately to the log. Example: " |
version
|
The Connect or OnDemand Tunnel protocol version, with 1.1 for currently supported releases. |
command
|
The type of command executed. These commands can appear in log file entries for the network tunnel service:
|
destination-ip:port
|
IP address and port number of the resource being accessed. For flows, this is the destination of the TCP, UDP or ICMP flow. For tunnels, this is the external address of the appliance (port number is always 0). Example: |
status code
|
See Auditing Connection Status Messages for more detail about the status codes. |
bytes-received
|
Number of bytes read from source. |
bytes-sent
|
Number of bytes written to destination. |
connection duration
|
Connection duration (in seconds) based on the time the tunnel was closed, a TCP flow entered its TIME_WAIT state, or a UDP or ICMP flow timed out. |
imei
|
Every mobile phone is assigned a unique, 15-digit IMEI code (device identifier)
that indicates information like the manufacturer, model type, and country of
approval. The IMEI can be displayed on most phones by dialling Example: If the IMEI code is not provided by the device, a platform identifier is shown. Platform identifiers (first character) are: W – Windows M – Mac L – Linux P – PDA A – AcitveSync Mobile X – Unknown (blank) – Mobile Phone |