---
title: "Private Access log attributes for SIEM integration"
canonical: "https://docs.aryaka.com/space/KNOW/794558469/Private%20Access%20log%20attributes%20for%20SIEM%20integration"
format: markdown
---
Aryaka's Private Access logs use a proprietary JSON format and are streamed to the SIEM integration endpoint as part of your SIEM configuration. When you configure SIEM, you can enable these and other supported log types. Private Access logs capture the following four types of VPN-related events: Connect—User successfully establishes a VPN session. Disconnect—User terminates or drops a VPN session. Login Error (no free IP pool)—No LAN IP addresses are available to assign to a client. Login Error (radius timeout or denial)—Authentication fails due to repeated incorrect passwords or a RADIUS server denial. The following are example log entries for each of these event types: Connect log {
        "timestamp": "Mar 23 04:19:34" //Convert this to epoch.
        "log_type": "Private Access Logs",
        "GwServer":"server55.del2",
        "event_type": "connect",
        "user": "dhananjay.goyal@lummustech.com",
        "ClientVpnLanIP": "10.64.115.152",
        "ClientVpnEp": "122.162.148.32"
        "ArykVpnEp": "103.29.34.1"
        "DomainGroup":"lum-2486-domain-group-01-row"
    } Disconnect log {
        "timestamp": "Mar 23 03:22:30" //Convert this to epoch.
        "log_type": "PrivateAccess",
        "ArykGwServer":"server55.ash1",
        "event_type": "disconnect",
        "user": "JKimble@woodmark.com",
        "tx_bytes": 11900971,
        "rx_bytes": 5768370,
        "connection_time": "00000323"
    } Login Error (no free IP pool) log {
    "timestamp": "Mar 25 06:49:22", //Convert this to epoch.
    "log_type": "PrivateAccess",
    "ArykGwServer":"server55.del2",
    "event_type": "LoginError",
    "error_code":"52501",
    "user": "bsharan@Woodmark.com",
    "error_message": "Ipcp: No free ip pool addresses"
} Login Error (radius denied) log {
    "timestamp": "Mar 25 03:42:59", //Convert this to epoch.
    "log_type": "PrivateAccess",
    "ArykGwServer":"server55.del2",
    "event_type": "LoginError",
    "error_code":"52501",
    "error_message": "Intruder warning: Radius denied",
    "user": "jeonghwa.choi@georgfischer.com"
} The following table displays Private Access log attributes and their definitions: Log Attribute Definition timestamp Log generation time in epoch (Unix time) format. If required, this can be converted to human-readable log time in  MMM DD HH:mm:ss  format. log_type Identifies the type of log:  "PrivateAccess" . event_type Type of VPN event:  "connect" ,  "disconnect" , or  "LoginError" . user Email ID or username of the VPN user involved in the event. ArykGwServer Aryaka Gateway server (POP) used to establish the VPN. ClientVpnLanIP Internal LAN IP address assigned to the user's VPN session. Present only in connect logs. ClientVpnEp Public IP address of the user’s endpoint device connecting to VPN. Present only in connect logs. ArykVpnEp Aryaka VPN Gateway server endpoint IP that the client connects to. Present only in connect logs. DomainGroup Domain or group that identifies your user set within Aryaka. While it may not be visible in your interface, it's used internally by Aryaka Support to troubleshoot and manage tenant-specific Private Access configurations. tx_bytes Total bytes transmitted (sent) by the user during the session. Present only in disconnect logs. rx_bytes Total bytes received by the user during the session. Present only in disconnect logs. connection_time Duration of the VPN session, typically in  HHMMSS  format (for example, "00000323" = 3 mins 23 secs). Present only in disconnect logs. error_code Numeric code identifying the error condition for login error events. error_message Human-readable explanation of the login error, for example,  no IP pool available  or  radius authentication denied . Related topics SIEM Configure SIEM integration