Monitoring Remote VPN Login Failures via Log Analyzer

abadshahc

Hello All,

Recently we faced an issue related to remote VPN user login failures, and we are trying to improve monitoring for this scenario.

I have configured an alert in SolarWinds Log Analyzer using the following log condition:

err apmd[5787]: 0149020a:3: /Common/ADFS-SP.app/ADFS-SP:Common:b6ecb817:SAML Agent: /Common/ADFS-SP.app/ADFS-SP_saml_auth_agSAML assertion is invalid, error: Invalid Session,possible use of different host names to access SAML SP

This appears to be related to a SAML authentication failure during VPN login.

I would like to confirm:

1. Is this the correct log pattern to monitor remote VPN login failures?
2. Has anyone implemented a better filtering or alerting method for similar SAML authentication errors?
3. Are there recommended best practices for monitoring VPN authentication failures in Log Analyzer?

Any suggestions or experiences would be greatly appreciated.

Thank you.

Lofstrand

Hi @abadshahc

Different vendors show VPN login failures in different ways. And different cause of issues might be logged in different ways.

So I you have issues from time to time, that give you above error - then it could be a good way of doing it. I would probably use only a part of that string, like

SAML Agent: /Common/ADFS-SP.app/ADFS-SP_saml_auth_agSAML assertion is invalid, error:

and potentially add some conditions, like source have to be the VPN devices.

But if this works in your environment, then good :-)