# APM: User session id and client ip sent to syslog server after login vpn.

**URL:** <https://community.f5.com/t/apm-user-session-id-and-client-ip-sent-to-syslog-server-after-login-vpn/18114>\
**Category:** Technical Forums\
**Tags:** irules, big-ip-access-policy-manager-apm, network-access, access-control, application-delivery\
**Created:** [June 17, 2016, 2:19am UTC](https://community.f5.com/t/apm-user-session-id-and-client-ip-sent-to-syslog-server-after-login-vpn/18114 "2016-06-17T02:19:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Demeter\_Luo\_168](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@Demeter\_Luo\_168](https://community.f5.com/u/Demeter_Luo_168)\
**Post date:** [June 17, 2016, 2:19am UTC](https://community.f5.com/t/apm-user-session-id-and-client-ip-sent-to-syslog-server-after-login-vpn/18114/1 "2016-06-17T02:19:57Z")

</div>

Hi Friends

We need to record user information(vpn session id & client ip) at each access internal netwok resource after the success of login F5-VPN.

Our APM is network access mode,Internal network have many tcp and udp application.I want each request these resources will be triggered the F5 to send user information(vpn session id & client ip) to the remote syslog server.How to do?

Thanks everyone

---

<div class="post-metadata">

**Author:** ![hari\_126827](https://avatars.discourse-cdn.com/v4/letter/h/f0a364/32.png) [@hari\_126827](https://community.f5.com/u/hari_126827)\
**Post date:** [June 17, 2016, 11:02am UTC](https://community.f5.com/t/apm-user-session-id-and-client-ip-sent-to-syslog-server-after-login-vpn/18114/2 "2016-06-17T11:02:42Z")

</div>

Hi,

Please see if below links could help in checking log on APM and divert the traffic to syslog server.,

session log on APM: [SOL11134: Locating a user’s session ID](https://support.f5.com/kb/en-us/solutions/public/11000/100/sol11134)

filter message on syslog: [SOL13333: Filtering log messages sent to remote syslog servers (11.x - 12.x)](https://support.f5.com/kb/en-us/solutions/public/13000/300/sol13333.html)

Off course, its also good idea to have [irule for APM](https://devcentral.f5.com/wiki/iRules.APM.ashx) for getting APM log.local1, wherein we can use ACCESS::user for getting userID, and ACCESS::session for getting session ID and IP address..

KRgds, Hari