john9527
Part of the Furniture
You can look in the syslog for the last string 'HTTP login' before the VPN messages and get the ip address of who was logged in at the timeWeeeelllll... looks like someone has been checking out the VPN page when they log in.