Needs to Trace user activity through firewall.

Hello,
I am using Cisco ASA firewall to connect remote users to Data Centers.
I want to capture only below mentioned two types of logs and save it to a Server.
# Who logged in through VPN.
# They accessed with servers in inside network.
Please provide me an overview, how I can filter only those two messages and send it to remote server.
Thanks in advance

hi,
you can use the same command but specify which VPN type you want to see, either webvpn (aka SSL VPN), anyconnect or RA VPN.
see sample below:
ciscoasa# show vpn-sessiondb anyconnect
Session Type: AnyConnect
Username     : anyconnect-user        Index        : 1
Assigned IP : 10.1.1.10              Public IP    : 192.168.1.17
Protocol     : IKEv2 IPsecOverNatT Clientless
License      : AnyConnect Premium
Encryption   : IKEv2: (1)AES256 IPsecOverNatT: (1)AES256 Clientless: (1)RC4
Hashing      : IKEv2: (1)SHA1 IPsecOverNatT: (1)SHA1 Clientless: (1)SHA1
Bytes Tx     : 51620                  Bytes Rx     : 98124
Group Policy : GroupPolicy_ANYCONNECT-PROF
Tunnel Group : ANYCONNECT-PROF
Login Time   : 16:28:49 SGT Tue May 13 2014
Duration     : 0h:03m:45s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none

Similar Messages

How to trace user activity like logs in pl/sql ?

Hi,
i would like to know is there an a way to trace the user activity like log can be done through any procedure ?
If you can tell me the related tables is enough . i can proceed further ?
Thanks
Rangan S

If you want to trace SQL statements, you can use SQL trace and TKPROF: http://download.oracle.com/docs/cd/B19306_01/server.102/b14211/sqltrace.htm#i4170
Edited by: P. Forstmann on Jul 31, 2009 10:05 AM

How to trace user activity

Dear guru
Please guide me, how to trace user activities in SAP. We are using ECC 6.0 version.

No interview questions.
Search before posting.
Read the "Rules of Engagement"
Theres plenty of information and threads about it.
Regards
Juan

Trace User Activity in SPM

HI,
We are tracing user activity in SPM like user logon/logoff time, which reports a user is accessing in the Portal etc. Please let us know what all details about user activity can be captured in SPM and what is the procedure to do so?
Regards
Neel

Hi Neel
SPM is an analytical app built on top of the NW platform. It doesnot have any platform (like tracking user logons) itself. How do you track the usage for non SPM products. Have you tried using those same mechanisms?
Regards
Rajesh

Want trace user activity sap user id wise

dear all,
please help me. how I trace a user'a activity in sap user id wise.for a given period, he use which tcodes & reports.
Regards
Abrar ahmed

Hi
You can perform the audit option for this user activty, but make sure that the enough space is available for the log generation.
Configure in SM19 the users required and check in SM20 the log.
OR
You can trace the user in ST01 and analyze the log.
Regards
Bhaskar
Edited by: bhaskar1818 on Jul 11, 2008 2:17 PM

Is it possible to trace an user activity?

Hello all,
Could you help me with some doubts...
I have an issue where I need to check what an user have done while
logged on portal, what objects he created/modified, is that possible?
I know we can trace activity reports by objects on PCD or by resources on KM,
but that is not enough for what I want.
We have one scenario where we got a role, a group and users, the users are
assigned to the group which is assigned to the role, I'd like to know when an
user assign/remove another user from the group. Also, there is a portal application
running on backgrounds, so sometimes the API itself assign/removes an user from the
group, where can I find these logs to know when the API or an user made changes on the
group?
Thanks in advance,
Rafael

Hi,
unfortunatly you can't trace the historic activities done by an user. You can, however, trace what he is doing right now. This is called E2E Trace Analysis (SolMan). This has to be done live, meaning: you have to sit next to the computer with the user and follow his activities. This is mainly done to look for performance bottle necks.
To trace the historic activities, the Portal only provides the Portal Activities Reports and Activity Data Collector.
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/e07edaa8-70ae-2b10-2390-f068636c8b1e
About the portal application running in the background: To trace the activity, the developer has to enable logs in the application during development (using either the portal default logs like default.trc or another one). If this is not enabled in the code of the application, you can't trace the activity. If logs are activated, the Administrator of the portal can then assign a log file (for INFO, ERROR, etc) to trace the app (configured inside Visual Administrator and viewed via the Log Viewer).
br,
Tobias

I lost my Iphone 4s and I need the iMei number to trace. THAT fellow actually off my phone at my last location.I dont have sim on that i phone.I am trying to trace the iphone through find my phone but it showing offline. Thus another way of solving w

I lost my Iphone 4s and I need the iMei number to trace. THAT fellow actually off my phone at my last location.I dont have sim on that i phone.I am trying to trace the iphone through find my phone but it showing offline. Thus another way of solving will be through IMEI number which i need to hand it over to the police! How can i get the iMei number? Can I use Itune? As previously, I did sync into iTunes before. Will it have the record of my iMEI number? PLEASE HELP ME!
iPhone 4S, iOS 7.0.1

how to find IMEI, etc
http://support.apple.com/kb/HT4061?viewlocale=en_US&locale=en_US

Thin JDBC through firewall - what ports need to be open?

We are running Oracle 7.3, and Oracle Web Server on the same
computer. The firewall is set up to allow connections to that
computer from anywhere, on ports 80 and 1521.
Our thin JDBC applet works perfectly from inside the firewall,
but from outside, I get a time-out error trying to open the JDBC
connection.
What else needs to be done get JDBC through? Do other ports need
to be open on the firewall?
The JDBC FAQ mentions a "Net8 compliant" or "SQLNet certified"
firewall - is that relevant to this problem, and if so, what does
it really mean?
We are supposed to be operational right now, so many many thanks
for any help on this!
- Joe Wielgosz
null

Try in the Lion Server Forum?
Regards,
Colin R.

Trace travel user activity

Hi guru's
How do I trace a users activity in travel module. I'm particularly interested in dates for
=> creation of travel requests
=> deletion of travel requests
regards

Once the trip (travel request) is deleted you have no information available about it.

User Activity Portlet

Anyone using the User Activity Portlet? If you have your Notification Service -> RSS Feeds configured to 'Gateway RSS Feed URLs', the User Activity portlet doesn't work.. I'll append the stack trace below. If you uncheck this option in config it fixes the User Activity portlet problem, but then the RSS feeds available through collab don't work - you can get around it by adding gateway parameters to all of the collab web services, but that is a terrible work around... just wondering if anyone has dealt with this before I submit a SR.
Thanks,
Jason
2-19-2009 10:58:48.961 Error Storybook Logger activityservice.nidis2.ncdc.noaa.gov.ali http-21030-exec-3 java.lang.Class Error in retrieving CNS feed: com.sun.syndication.io.ParsingFeedException: Invalid XML: Error on line 1: The reference to entity "redirect" must end with the ';' delimiter.
com.sun.syndication.io.ParsingFeedException: Invalid XML: Error on line 1: The reference to entity "redirect" must end with the ';' delimiter.
at com.sun.syndication.io.WireFeedInput.build(WireFeedInput.java:182)
at com.sun.syndication.io.SyndFeedInput.build(SyndFeedInput.java:122)
at com.bea.shaboo.impl.support.UserActivityBean.getActivityList(UserActivityBean.java:74)
at com.bea.shaboo.impl.support.UserActivityBean.getActivityStreamModel(UserActivityBean.java:177)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.myfaces.el.PropertyResolverImpl.getProperty(PropertyResolverImpl.java:400)
at org.apache.myfaces.el.PropertyResolverImpl.getValue(PropertyResolverImpl.java:71)
at org.apache.myfaces.el.ELParserHelper$MyPropertySuffix.evaluate(ELParserHelper.java:532)
at org.apache.commons.el.ComplexValue.evaluate(ComplexValue.java:145)
at org.apache.myfaces.el.ValueBindingImpl.getValue(ValueBindingImpl.java:378)
at javax.faces.component.UIData.getValue(UIData.java:779)
at org.apache.myfaces.component.html.ext.HtmlDataTableHack.createDataModel(HtmlDataTableHack.java:350)
at org.apache.myfaces.component.html.ext.HtmlDataTableHack.getDataModel(HtmlDataTableHack.java:333)
at org.apache.myfaces.component.html.ext.HtmlDataTableHack.getRowCount(HtmlDataTableHack.java:75)
at org.apache.myfaces.custom.datalist.HtmlListRenderer.encodeChildren(HtmlListRenderer.java:107)
at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:319)
at javax.faces.webapp.UIComponentTag.encodeChildren(UIComponentTag.java:343)
at javax.faces.webapp.UIComponentTag.doEndTag(UIComponentTag.java:251)
at org.apache.myfaces.taglib.UIComponentBodyTagBase.doEndTag(UIComponentBodyTagBase.java:55)
at org.apache.jsp.useractivityfeed_jsp._jspx_meth_t_005fdataList_005f0(useractivityfeed_jsp.java:442)
at org.apache.jsp.useractivityfeed_jsp._jspx_meth_h_005fform_005f0(useractivityfeed_jsp.java:247)
at org.apache.jsp.useractivityfeed_jsp._jspx_meth_f_005fview_005f0(useractivityfeed_jsp.java:178)
at org.apache.jsp.useractivityfeed_jsp._jspService(useractivityfeed_jsp.java:108)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:393)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:654)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:445)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:379)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:292)
at org.apache.myfaces.context.servlet.ServletExternalContextImpl.dispatch(ServletExternalContextImpl.java:415)
at org.apache.myfaces.application.jsp.JspViewHandlerImpl.renderView(JspViewHandlerImpl.java:234)
at org.apache.myfaces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:352)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:107)
at org.apache.myfaces.webapp.MyFacesServlet.service(MyFacesServlet.java:74)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.bea.shaboo.impl.servlet.RequestedUserFilter.doFilter(RequestedUserFilter.java:61)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.bea.shaboo.impl.servlet.AccountCreationFilter.doFilter(AccountCreationFilter.java:57)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.bea.shaboo.impl.servlet.KodoSessionFilter.doFilter(KodoSessionFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.bea.shaboo.impl.servlet.ShabooSecurityFilter.doFilter(ShabooSecurityFilter.java:74)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.bea.shaboo.impl.servlet.InitializationCheckFilter.doFilter(InitializationCheckFilter.java:42)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:263)
at org.apache.coyote.http11.Http11NioProcessor.process(Http11NioProcessor.java:887)
at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:696)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:2009)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:650)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:675)
at java.lang.Thread.run(Thread.java:595)
Caused by: org.jdom.input.JDOMParseException: Error on line 1: The reference to entity "redirect" must end with the ';' delimiter.
at org.jdom.input.SAXBuilder.build(SAXBuilder.java:468)
at org.jdom.input.SAXBuilder.build(SAXBuilder.java:851)
at com.sun.syndication.io.WireFeedInput.build(WireFeedInput.java:178)
... 71 more
Caused by: org.xml.sax.SAXParseException: The reference to entity "redirect" must end with the ';' delimiter.
at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
at org.apache.xerces.util.ErrorHandlerWrapper.fatalError(Unknown Source)
at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
at org.apache.xerces.impl.XMLScanner.reportFatalError(Unknown Source)
at org.apache.xerces.impl.XMLScanner.scanAttributeValue(Unknown Source)
at org.apache.xerces.impl.XMLNSDocumentScannerImpl.scanAttribute(Unknown Source)
at org.apache.xerces.impl.XMLNSDocumentScannerImpl.scanStartElement(Unknown Source)
at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentContentDispatcher.dispatch(Unknown Source)
at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
at org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown Source)
at org.apache.xerces.jaxp.SAXParserImpl$JAXPSAXParser.parse(Unknown Source)
at org.jdom.input.SAXBuilder.build(SAXBuilder.java:453)
... 73 more
<ptLogMsgEnd>

AquaLogic Notification Service: RSS Feeds
Enable Basic Authentication Enabled
Gateway RSS Feed URLs Enabled
ALUI Directory : is working fine as I have installed Softerra and checked it myself.
Collaboration: AquaLogic Notification Service Client is working fine and is pointed to the machine on which the notification service is installed
Activity Service
Activity Service: Common Notification Service Client
I am pointing this to the machine where the Notification service is installed.
RSS Reader Portlet configuration:
Do I need to preset this the domain?
I currently get the following message when i click on the rss image in collab
HTTP Status 400 - Invalid path /project/module/ was requested
type Status report
message Invalid path /project/module/ was requested
description The request sent by the client was syntactically incorrect (Invalid path /project/module/ was requested).
Apache Tomcat/6.0.14
G
Edited by: ALUIDeveloper on Feb 19, 2009 9:37 AM

Client connecting through firewall

Hi
          We have two clustered servers.Our client is connecting through
          firewall NAT. When iam connect to first server the response is very slow and
          at the same time clustering is not working.If i stop the second server the
          response fast .
          The same configaration is working fine when my client is local.
          Can you explain the reason for this problem ?
          Presently iam using weblogic 6.1 version.
          Thank you


OK I spoke too soon. The user looked like it was working but it was working because it matched another IAS policy further down the list. It seems as though the PIX refuses to use ms-chap of any sort. If I include the authentication type in the VPN policy conditions as ms-chap, it skips the VPN policy I am using to authenticate this. If I remove it, then it gives an invalid authentication type as if whatever the PIX is sending the IAS server does not understand as ms-chap.
It seems like the PIX authentication is totally wrong for use with IAS. What else do I need to add to this configuration to gewt it to work with ms-chap of any kind? I really don't get it.

Trace user on EP6 when navigating within Portal

Hi Team,
We have migrated from EP5 to EP6 sp2.
Our users that are working via the Metaframe XP are experiencing problems when navigating within Portal.
eg. If the user selects ESS, the screen returns back to the same screen. It was working fine on EP5.
Users that do not use the Metaframe are working fine on EP6.
I need to trace the user activity from the time the user
signs onto Portal and signoff.
I tried looking at trace files on the OS level and i also
enabled the HTTP tracing, but had very little joy.
I suspect it might be a Browser cookie problem.
Could someone help with this problem.
Points will be rewarded !!
Kind Regards,
Morgan Moodley

A couple of things you could try
1) Try clearing the browser cache, as there may still be files hanging around from the EP5 system that the EP6 system doesn't like.
As for tracing the user activity, you could use a browser sniffing tool and simulate what the user is doing. I personally use HttpWatch, which sits in the IE browser as an icon in the top toolbar. When activated this will detail all requests and responses to and from the browser. I am not too sure how much this information will help with trying to identify the problem, but it could be a start.
It might also be worth trying to use Firefox and looking in the Javascript console to see if there are any javascript errors
I hope this helps a little
Darrell

How to trace enduser activity and changes made by enduser

Dear experts,
how to put full fludged trace on enduser activity.
that is i want to do the following activity:-
*i should know the end user activity. (login details and T-codes accessed by users)
*should know the changes made by the users.
*i need to collect all these in the form of logs, so that i can archive it to network.
and wht kind of security is best preffered by audit people.
i request you all to give some valuable inputs on these questions.
thanking you all
best regards
Raghav

Hi noothangi,
Transactions SM18, SM19, SM20 deals with security Audit Log.
SM18
To archieve or delete old audit log files
SM19
you can configure the Static/Dynamic fileters here.
The system administrator or security administrator defines the events you
want to audit in filters. Filters consist of the following information:
. Client
. User
. Auditclass
. Weight of events to audit
The audit class returns information about the following:
. Dialog logon
. RFC/CPIClogon
. Remotefunctioncall(RFC)
. Transaction start
. Reportstart
. User master change
You can specify the weight of events to audit:
. Audit only critical
. Audit important and critical
. Auditallevents
SM20
SM20 to assess the security audit log.
Soppose if you wanted to find out the transaction run by a perticular user in certain period, You can get this information in SU20.
Please visite:
http://help.sap.com/saphelp_46c/helpdata/en/95/d2a8e96d6611d1a5700000e835363f/frameset.htm
http://help.sap.com/saphelp_nw04s/helpdata/en/8a/a8b5386f64b555e10000009b38f8cf/frameset.htm
The above matter is from the below post.
usage of SM18, SM19, SM20
Cheers
Soma

Need API for user creation

Dear All,
I need to use bulk user creation through API. Please advice which API i use to resolve this issue.
Thanks
Rehan

I need to use bulk user creation through API. Please advice which API i use to resolve this issue.FND_USER_PKG.CREATEUSER
FND_USER_PKG
https://forums.oracle.com/forums/search.jspa?threadID=&q=FND_USER_PKG&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
PACKAGE: APPS.FND_USER_PKG
http://etrm.oracle.com/pls/et1211d9/etrm_pnav.show_object?c_name=FND_USER_PKG&c_owner=APPS&c_type=PACKAGE
Thanks,
Hussein

WHAT IS THE MECHANISM FOR AUDITING PORTAL USER ACTIVITY

Is there any default mechanism for auditing a portal users access to
tables. At the DB level, we are seeing the portal_public user but we want to see the portal user instead; e.g. we need to report on activity such as: portal user johndoe deleted a row of data from a table.
johndoe is only a portal user not a database user.
We are trying to keep from writing additional custom code to auditing. We are
using wwctx_api.get_user_id in other parts of the application and we would like
to avoid writing a custom auditing module.

William,
I'm not sure if this is what you are looking for, but...
When you create (or edit) a component in Portal 10g, there is a Log Activity check box. If you check this box, then go to Manage the component (in the Portal Navigator), there are Develop, Manage and Access tabs. The Manage tab has a Monitor icon, which has the information you may be looking for. This does not seem to be available directly for database tables. However, I created a Calendar, based on a database table I created to keep track of the Calendar Events. I also created a form to allow users to add Calendar Event entries. I turned logging on for both components. The Monitoring allows me to see when each user has accessed the Calendar, and who and when they insert, update or delete entries from the Calendar table.
-Ricky Burke

Needs to Trace user activity through firewall.

Similar Messages

Maybe you are looking for