Skip to main content

Tutorial: Query the Access Server Log Database Using the Web API

Abstract

Query the OpenVPN Access Server log database using the Web API. Retrieve VPN and Admin Web UI activity logs by user, date range, or service type for troubleshooting and auditing.

Overview

Access Server maintains a log database that records VPN and web service activity. You can use the Web API to query this database for troubleshooting, auditing, reporting, and monitoring purposes.

This tutorial provides example API calls to retrieve activity logs by time ranges, users, and service types.

Tip

This tutorial uses the sacli apicall command, but you can also use cURL or the Swagger UI. Refer to Tutorial: Test the New Web API (OpenAPI) in Access Server 3.0.

Before you begin

All examples in this tutorial assume you're connected to the Access Server console with root privileges.

Tip

API log queries return timestamps in UTC.

If you need logs displayed in your local timezone, use the Admin Web UI → Status → Activity Log.

About the log reporting endpoint

Access Server provides the following endpoint for querying activity logs:

/api/log/reports

This endpoint can be filtered by:

  • Time range

  • User

  • Service type

  • Sort order

  • Pagination options

Customize query results

The examples in this tutorial use the following settings:

  • page size: 25 — returns up to 25 records.

  • offset: 0 — starts with the first page of results.

  • order_by: timestamp — sorts by event time.

  • sort_by: desc — displays the newest events first.

Modify these values to match your reporting requirements.

Prerequisites

  • Access Server 3.1.0 or newer.

  • Root privileges on your Access Server's console.

  • (Optional) A remote machine for running API calls.

Important

The API specification can change between Access Server versions. Verify the API specification for your version before using these commands.

Refer to: View the API specification.

Query recent activity

Show activity from the last five days

sacli --method POST --url 'api/log/reports' --value '{"offset":0,"page_size":25,"order_by":"timestamp","sort_by":"desc","filters":{"start_time":{"start_relative":"5d"}}}' apicall

Result

Returns the 25 most recent activity records from the last five days.

Query activity for a specific user

Show activity from the last 5 days for a user

sacli --method POST --url 'api/log/reports' --value '{"offset":0,"page_size":25,"order_by":"timestamp","sort_by":"desc","filters":{"start_time":{"start_relative":"5d"},"username":{"operation":"equal","value":"<USER_NAME>"}}}' apicall

Result

Returns activity records for the specified user from the last five days.

Query activity using a date range

Show activity between two dates

sacli --method POST --url 'api/log/reports' --value '{"offset":0,"page_size":25,"order_by":"timestamp","sort_by":"desc","filters":{"start_time":{"start":"2026-04-28","end":"2026-04-29"}}}' apicall

Result

Returns activity records that occurred between the specified start and end dates.

Note

Update the dates to match the reporting period you want to query.

Query VPN activity

Show VPN sessions

sacli --method POST --url 'api/log/reports' --value '{"offset":0,"page_size":25,"order_by":"timestamp","sort_by":"desc","filters":{"service":{"operation":"equal","value":"VPN"}}}' apicall

Result

Returns activity records related to VPN connections and sessions.

Query Admin Web UI activity

Show Admin Web UI sessions

sacli --method POST --url 'api/log/reports' --value '{"offset":0,"page_size":25,"order_by":"timestamp","sort_by":"desc","filters":{"service":{"operation":"equal","value":"WEB_ADMIN"}}}' apicall

Result

Returns activity records related to Admin Web UI access.

In this section:
See also: