# Monitor failed Cisco Anyconnect VPN connection attempts **URL:** \ **Category:** ASA\ **Created:** [September 25, 2018, 10:58am UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991 "2018-09-25T10:58:53Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![charlesbreslin](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/c/848f3c/32.png) [@charlesbreslin](https://forum.networklessons.com/u/charlesbreslin)\ **Post date:** [September 25, 2018, 10:58am UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991/1 "2018-09-25T10:58:53Z")
Our clients should authenticate via certificate but for our DR datacentre site ASA authentications are failing. All works Ok from the same Anyconnect client to the ASA at our primary datacentre. Can someone point me in the right direction how to check the ASA log files to get some sort of error message or reason for the failures. The command line log file only has a couple of pages of entries. I’m guessing i can use ASDM real time log viewer. But what search criteria do i enter. The users username shows no entries. Many thanks in advance. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [September 25, 2018, 4:32pm UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991/2 "2018-09-25T16:32:43Z")
Hello Charles It is possible to configure syslog messages to be sent when the user connects and disconnects. There are various kinds of connections that can be logged including anyconnect/ssl vpn clients. For VPN client based connections like AnyConnect, the syslogs are usually of the form 722xxx. For example, connect is 722022 and disconnect is 722023. You can find additional related messages here: > **[Cisco Secure Firewall ASA Series Syslog Messages - Syslog Messages 722001...](https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html)** > > Syslog Messages > 722001 to 776020 As for the configuration of the logging, this can be done either with command line or ADSM configuration methods. Take a look at the following link which includes aspects of both of these options: > **[Configure Adaptive Security Appliance (ASA) Syslog](https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc4)** > > This document describes sample configuration that demonstrates how to configure different logging options on ASA that runs code Version 8.4 or later. I hope this has been helpful to get you started. Laz ---
**Author:** ![charlesbreslin](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/c/848f3c/32.png) [@charlesbreslin](https://forum.networklessons.com/u/charlesbreslin)\ **Post date:** [October 18, 2018, 10:53am UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991/3 "2018-10-18T10:53:44Z")
Just to update our resolution to this issue. It was caused by us upgrading our Cisco Anyconnect clients to version 4 and a bug / feature in the way that works with ASA version 9.6 !! In Cisco ASA version 9.6 and Anyconnect client version 4 the backup vpn connection url needs to have the user group profile explicitly defined. So for example if your user group profile = ACME-VPN Anyconnect version 4 does not have the intelligence to apply the user group profile ACME-VPN to the backup server [vpn-backup.ACME.co.uk](http://vpn-backup.ACME.co.uk). It has to be explicity defined. So on the ASA connection profile the BackupServerList HostAddress vpn url needed with Anyconnect version 4 = [vpn-backup.ACME.co.uk/ACME-VPN](http://vpn-backup.ACME.co.uk/ACME-VPN) Anyconnect version 3 had the intelligence to apply the user group profile ACME-VPN to the backup server [vpn-backup.ACME.co.uk](http://vpn-backup.ACME.co.uk). So on the ASA connection profile BackupServerList HostAddress vpn url needed = [vpn-backup.ACME.co.uk](http://vpn-backup.ACME.co.uk) ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [October 23, 2018, 1:20am UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991/4 "2018-10-23T01:20:45Z")
Charles thanks so much for sharing your resolution to the problem. Such post are extremely valuable to all forum users. Thanks once again! Laz