Is there an event ID or msg ID for Juniper VPN failed host check

[EricSchwartz1]

I am attempting to find failed login event id for juniper vpn?  Would there be a msg or event id so we can use it in a query

[JamesMoon · Accepted solution]

Hi Eric,

These are the messages IDs that are associated with failed/rejected login events as shown in /etc/netwitness/ng/envision/etc/devices/junipervpn/v20_junipervpnmsg.xml.

Login failed: 000154, 000155, 000157, 000159, 000160, 000162, 000163, 000165, 000168

Login rejected: 000161, 000164, 000167, 000169

Thanks.