I've been trying to drill down beyond the level of detail the VPN report gives (to get the raw event logs and timestamps, plus events during the VPN session).
But when I look in the archive directory and unzip the files for the timeframes, I can't find the syslog messages that produced the VPN report information I do have.
Example:
The VPN report says that in a timeframe in October a particular username logged in several times. Looking through the entire October timeframe of raw logs, I can't see any reference to that username in any syslog message though I can see syslog messages right through the timeframe and other login messages...
I'm Really Confused.
Anyone got a suggestion where I might be able to find the log entries relating to that login?