This 'alert' log never contains any real client IPs, only their internal VPN IP (10.x.x.x), and it's rotated/purged often.<br> Historical bandwidth usage data is collected by vnstat, but this data is NOT per-session or per-instance, it's for the entire server.