Event logs
The Cybels VPN client has a built-in logging mechanism that can record events relating to the operation of the application, including the local context in which it is run.
The log files generated by the mechanism contain various details, such as when the application starts and shuts down, configuration settings, when the tunnel is opened and closed, as well as error messages, warnings and information messages.
These logs are collected and can be read locally on the user's workstation through the Windows Event Manager (also known as Event Viewer), which can be accessed from the Start/Event viewer menu, or by running the command eventvwr.msc.
In the Cybels VPN Premium version, logs can also be consulted in managed mode through an EMM/GPO with a remote AD server.
Three log families are available: audit logs, technical logs and functional logs.
Audit logs
The following is the list of the various audit logs:
| Audit type | ID | Severity | What this audit indicates | Parameters | Example | Remarks |
|---|---|---|---|---|---|---|
| App.Start | 101 | Info | The application was started | The software version (softwareVersion), and whether managed mode is enabled (Managed) | App.Start softwareVersion: 0.5.99.16 Managed: no | |
| App.Stop | 102 | Info | The application was shut down | App.Stop | This audit may not be saved if the application shuts down unexpectedly | |
| Tunnel.Start | 201 | Info | A tunnel was initiated | Tunnel name (tunnelName) | Tunnel.Start tunnelName: Official_Ercom | This audit indicates that a tunnel was initiated, but does not indicate whether the connection was successful or failed |
| Tunnel.Stop | 202 | Info | A tunnel was shut down | Tunnel name (tunnelName) | Tunnel.Stop tunnelName: Official_Ercom | |
| Config.CreateTunnel | 301 | Info | A tunnel was created | Tunnel name (tunnelName), tunnel mode (DR or not) | Config.CreateTunnel tunnelName: valid_standard_cert isDr: no | |
| Config.ModifyTunnel | 302 | Info | A tunnel was modified | Tunnel name (tunnelName) | Config.ModifyTunnel tunnelName: valid_standard_cert | |
| Config.DeleteTunnel | 303 | Info | A tunnel was deleted | Tunnel name (tunnelName) | Config.DeleteTunnel tunnelName: valid_standard_cert | |
| Config.TunnelChange | 304 | Info | New configuration for a tunnel | Tunnel name (tunnelName), parameters in question in key-value format | Config.TunnelChange tunnelName: valid_standard_cert fieldName: IkeKeyExchange fieldValue: Group 14 | See note below |
| Config.ExportConfig | 305 | Info | A configuration was exported | Config.ExportConfig | ||
| Config.ImportConfig | 306 | Info | A configuration was imported | Config.ImportConfig |
- Config.TunnelChange appears when a tunnel is either added or modified
- When a tunnel is added, the parameters of the new tunnel are shown => one event for each parameter
- When a tunnel is modified, only the parameters that were changed are shown (the new value) => one event for each modified parameter
- Some parameters cannot be shown: PSK (for security reasons), certificates (for technical reasons)
Technical logs
In a future version