This counter tracks sessions that were successfully established but later terminated abnormally, rather than via a clean logoff or an explicit management action. An admin seeing this climb steadily, separate from clean disconnects, should suspect network instability, client crashes, or an aggressive idle-timeout tearing down otherwise-healthy tunnels. A pattern of abnormal terminations clustering around a particular time of day might point to a scheduled network maintenance window or ISP flapping affecting remote users.