I've used kiwi syslog server on a external PC, and created some filters to log the lines below.
See the lines sa created and deleting SA
These are the config lines on a Cisco pix logging on logging timestamp logging buffered informational logging trap informational logging host inside 10.32.2.11 logging host inside 10.64.1.33
regards oTTo
=============LOG ON EXTERNAL PC===========================================================
2005-09-24 20:34:01 Local4.Info 10.64.1.254 Sep 24 2005 20:33:57: %PIX-6-109005: Authentication succeeded for user 'vpn-client' from
213.aaa.bbb.ccc (client) /0 to 82.xx.yy.zz (HQ.provider.nl) /0 on interface outside
2005-09-24 20:34:01 Local4.Info 10.64.1.254 Sep 24 2005 20:33:57: %PIX-6-602301: sa created, (sa) sa_dest= 82.xx.yy.zz (HQ.provider.nl) , sa_prot= 50, sa_spi= 0xb6c9671b(3066652443), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 18
2005-09-24 20:34:01 Local4.Info 10.64.1.254 Sep 24 2005 20:33:57: %PIX-6-602301: sa created, (sa) sa_dest= 213.aaa.bbb.ccc (client) , sa_prot=
50, sa_spi= 0x5c7537e3(1551185891), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 17
2005-09-24 20:34:01 Local4.Critical 10.64.1.254 "Sep 24 2005 20:33:57: %PIX-2-109011: Authen Session Start: user 'vpn-client', sid 21"
2005-09-24 20:34:04 Local4.Info 10.64.1.254 Sep 24 2005 20:34:00: %PIX-6-602301: sa created, (sa) sa_dest= 82.xx.yy.zz (HQ.provider.nl) , sa_prot= 50, sa_spi= 0xbfdd2f32(3218943794), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 13
2005-09-24 20:34:04 Local4.Info 10.64.1.254 Sep 24 2005 20:34:00: %PIX-6-602301: sa created, (sa) sa_dest= 213.aaa.bbb.ccc (client) , sa_prot=
50, sa_spi= 0x559d29fc(1436363260), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 14
2005-09-24 20:36:20 Local4.Info 10.64.1.254 Sep 24 2005 20:36:16: %PIX-6-602302: deleting SA, (sa) sa_dest= 82.xx.yy.zz (HQ.provider.nl) , sa_prot= 50, sa_spi= 0xbfdd2f32(3218943794), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 13
2005-09-24 20:36:20 Local4.Info 10.64.1.254 Sep 24 2005 20:36:16: %PIX-6-602302: deleting SA, (sa) sa_dest= 213.aaa.bbb.ccc (client) , sa_prot= 50, sa_spi= 0x559d29fc(1436363260), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 14
2005-09-24 20:36:20 Local4.Info 10.64.1.254 Sep 24 2005 20:36:16: %PIX-6-602302: deleting SA, (sa) sa_dest= 82.xx.yy.zz (HQ.provider.nl) , sa_prot= 50, sa_spi= 0xb6c9671b(3066652443), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 18
2005-09-24 20:36:20 Local4.Info 10.64.1.254 Sep 24 2005 20:36:16: %PIX-6-602302: deleting SA, (sa) sa_dest= 213.aaa.bbb.ccc (client) , sa_prot= 50, sa_spi= 0x5c7537e3(1551185891), sa_trans= esp-des esp-md5-hmac , sa_conn_id= 17