Secure Mobile Access 12.4 Administration Guide

Network Tunnel Audit Log

The network tunnel audit log provides detailed information about connection activity, including the status of completed tunnel connections and the status of completed flows within tunnels.

The two record types can be distinguished by the word flow or tunnel appearing in the sixth field of the message.

Messages are stored on disk in the file /var/log/aventail/extranet_access.log and contain these parameters:

[source-ip:port] [authentication] "[username@realm]" "[date/time]" [version] [command]

[destination-ip:port] [status code] [bytes-received] [bytes-sent] [connection duration] [imei]

This example illustrates a network tunnel service audit log file entry:

12.230.158.210:1110 ssl:LDAP "fred figment" "13/Sep/2016:19:18:28 -0700" v1.1 flow:tcp

192.168.136.254:22 0 21722 60631 263 490236207159217

The log entries contain the fields (separated by spaces) shown in the Network tunnel audit log fields table.

Network tunnel audit log fields
FieldDescription
source-ip:port

For tunnel records this field contains the source address of the outer tunnel connection. For flows this field contains the inner flow source address, which is the virtual IP address assigned from a tunnel pool when the tunnel is established.

Example:12.230.158.210:1110

authentication

A hyphen (-) indicates re-authentication via TEAM credential.

An explicit value is not possible, because the tunnel does not know the authentication method used to negotiate the TEAM credential.

"username@realm"

User accessing the resource, and the realm he or she is logged in to. The format of this field varies, depending on the authentication method used.

Example: "mfigment@employees"

"date/time"

Date (in date/month/year format) and time (hours, minutes, seconds, and milliseconds in 24-hour-clock format and hours of time zone +/- GMT) the connection began.

Records containing date/time may not be written immediately to the log.

Example: "13/Sep/2016:19:18:28 -0700"

versionThe Connect or OnDemand Tunnel protocol version, with 1.1 for currently supported releases.
command

The type of command executed. These commands can appear in log file entries for the network tunnel service:

tunnel

flow:tcp

flow:udp

flow:icmp

destination-ip:port

IP address and port number of the resource being accessed. For flows, this is the destination of the TCP, UDP or ICMP flow. For tunnels, this is the external address of the appliance (port number is always 0).

Example: 192.168.136.254:22

status code

0 is success.

See Auditing Connection Status Messages for more detail about the status codes.

bytes-receivedNumber of bytes read from source.
bytes-sentNumber of bytes written to destination.
connection durationConnection duration (in seconds) based on the time the tunnel was closed, a TCP flow entered its TIME_WAIT state, or a UDP or ICMP flow timed out.
imei

Every mobile phone is assigned a unique, 15-digit IMEI code (device identifier) that indicates information like the manufacturer, model type, and country of approval. The IMEI can be displayed on most phones by dialling *#06#. It’s also shown on the compliance plate underneath the battery.

Example: 352711-01-521146-5

If the IMEI code is not provided by the device, a platform identifier is shown. Platform identifiers (first character) are:

W – Windows

M – Mac

L – Linux

P – PDA

A – AcitveSync Mobile

X – Unknown

(blank) – Mobile Phone

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.