PulseSecure

PulseSecure VPN can be configured to send logs via syslog to Logmanager. In order for parser to work, logs need to be sent in WELF format.

To configure PulseSecure logging in WELF format:

1. Select System > Log/Monitoring > User Access.

2. Click the Settings tab to display the configuration page.

3. Specify the maximum log size - you can leave it on default.

4. Select the events to be logged: Logon/Logout, SAM/Java, User Settings, Meeting Events, Active Sync Proxy, HTML5 Access, Web Requests, File Requests, Meeting, Secure Terminal, VPN Tunnelling, SAML.

   You can select other events, but we cannot guarantee they will be parsed properly, as parser was written for above configuration.

5. Specify the server configuration:

   • IP Address of Logmanager instance.
   • acility (choose from level 0 to 7 - doesn’t really matter).
   • Type: choose TCP for better reliability.
   • Client Certificate: leave empty.
   • Filter: WELF

6. Save the configuration.

   

Detailed guide can be found here: https://docs.pulsesecure.net/WebHelp/Content/PCS/PCS_AdminGuide_8.2/Configuring%20Syslog.htm