The Cisco ASA 5510 here at work is being decommissioned and I want to find out what users used it alot. I didn't set this thing up myself, but it would be nice to add the same users to the new system by finding out a list of the old users.
If you have a month or so, you could use a script to read the log files.
I have a perl script that basic opens the log file and looks for the following
You can then spit the user name out into a variable and count.
I would love to give you the code, but, its tightly integrated into a management toolkit that i wrote.
To push the data to a syslog server you need the following commands.
The above switches on logging, Logs with a timstamp, sets logging to "error" and then sets where to send the logs
The other statements change the default level of certain log messages that might be usefull for you. (Normally they are not logged at the error level)