Any way to get detailed inbound/outbound traffic logs?

Question

I can find where to get session info on SSL VPN connections, but I can't find a log showing detailed SSL VPN traffic. Any ideas?

Jaydeep · Answer

Hi Ryan Swin 
 You can use Daily Executive reports which also includes information about VPN users and usage. You can configure it at Logging & Reporting > Executive Report > Configuration . Alternatively, you can see reports at Logging & Reporting > Remote Access . And if you want to see detailed SSL VPN logs including connections being established, please check for SSL VPN logs in Logging & Reporting > View Log Files > Today's Log Files or Logging & Reporting > View Log Files > Archived Log Files .

Jaydeep · Answer

Hi Ryan Swin 
 No, it would not be possible for UTM to log the traffic to these details. It would consume the logs disk and the resource in only logging this traffic details which would be counterproductive to main purpose of a firewall. 
 However, you can use TCPDUMP in SSH of UTM to check live traffic details. Please note that UTM can not store that for a later-viewing purpose. Please refer to this KBA Sophos UTM: How to capture packets and download the Packet Capture for more details on how to capture live traffic in UTM 9.