How can you determine when a client connects and disconnects from an OpenVPN server?

Question

openvpn

Is there any way to determine when a client connects and disconnects from the OpenVPN server, perhaps via an API? If so, how? If there is no standard way, then what are non-standard ones?

Answer 1

There are the following options for the server:
--client-connect cmd
--client-disconnect cmd

Answer 2

Add the following to the server config:
script-security 2 # to run scripts
client-disconnect "scripts/on-client-disconnect.sh"
Script preparation.
/etc/openvpn/script/on-client-disconnect.sh

#!/bin/bash
## Parse variables

if [ ! -z "${time_ascii}" ]; then
  sessionStart=${time_ascii}
else
  sessionStart="UNSET"
fi

if [ ! -z "${trusted_ip}" ]; then
  clientHostAddress=${trusted_ip}
else
  clientHostAddress="UNSET"
fi

if [ ! -z "${username}" ]; then
  clientUID=${username}
else
  clientUID="UNSET"
fi

if [ ! -z "${time_duration}" ]; then
  sessionDuration=${time_duration}
else
  sessionDuration="UNSET"
fi

if [ ! -z "${bytes_sent}" ]; then
  txVolume=${bytes_sent}
else
  txVolume="UNSET"
fi

if [ ! -z "${bytes_received}" ]; then
  rxVolume=${bytes_received}
else
  rxVolume="UNSET"
fi

if [ ! -z "${common_name}" ]; then
  client_cn=${common_name}
else
  client_cn="UNSET"
fi

## Send to syslog
logger -t openvpn -- "Disconnect: CommonName: ${client_cn} Username: ${clientUID} HostIP: ${clientHostAddress} Duration: ${sessionDuration} seconds opened at ${sessionStart} Session Traffic: TX: ${txVolume} bytes RX: ${rxVolume} bytes"

The log will contain such entries that you can then parse.
Sep 17 17:02:35 gw1-vpn openvpn: Disconnect: CommonName: vpn-client14 Username: UNSET HostIP: 444.555.666.777 Duration: 755 seconds opened at Sat Sep 17 16:50:00 2016 Session Traffic: TX: 20676207 bytes RX : 3596392 bytes
In a script, you can always run export and merge it into a file. You will see there the variables that OpenVPN has set.
And do not forget to set the startup attribute for the script and add a rule to selinux that allows the openvpn daemon to access this file.