When performing a force-logout on a user, how will this activity show in the GlobalProtect Logs?

When performing a force-logout on a user, how will this activity show in the GlobalProtect Logs?

892
Created On 06/24/22 23:22 PM - Last Modified 03/11/25 23:24 PM


Question


If I force logout all users or a user, what should be expected for confirmation of the logout?
 

Environment


  • Prisma Access Mobile Users
  • On Prem Portal/Gateway

Answer


  1. When a force logout event occurs, this will show similarly to when a user gracefully signs out, disconnects or disables the GP application from their client end.
  2. The action will be shown as a configuration release followed by a gateway logout event.
  3. Example logs given below
  • 20xx/06/21 14:24:03 GlobalProtect_E success gateway-logout US kmal
  • 20xx/06/21 14:24:03 GlobalProtect_E success gateway-config-release US kmal

Additional Information


Reference: How to Remote Disconnect SSL-VPN or GlobalProtect Users
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqBfCAK&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail