Security

Reply
mke
Occasional Contributor II
Posts: 11
Registered: ‎10-31-2016

Clearpass Guest application logs into external server

Hi,

 

I do have syslog targets in CPPM, the problem is I dont know how to define export filter that will export application logs from clearpass guest.

 

Specifically I need info about new user accounts with all details that applications logs have but are limited to 15 days on aruba itself.

Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

There is an active feature enhancement request for this, but it is not committed to a release yet.

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

There is an active feature enhancement request for this, but it is not committed to a release yet.

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
mke
Occasional Contributor II
Posts: 11
Registered: ‎10-31-2016

Re: Clearpass Guest application logs into external server

So there is no way to gather logs about newely created accounts into external server as of today?

Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

You will get all audit record logs that appear in Policy Manager Audit Viewer via syslog by using the "Audit Records" export template.

 

Guest account creation and changes appear in that log. You just won’t see the raw log data that you get in “Application Log” on the guest side.

 

audit-viewer_guest-account.png

 

syslog_audit-filter.png

 


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
mke
Occasional Contributor II
Posts: 11
Registered: ‎10-31-2016

Re: Clearpass Guest application logs into external server

The problem is that logs does not contain what you see in Audit viewer

 

It looks like that

 

March 23rd 2017, 14:55:14.248    <143>2017-03-23 14:55:14,245 x.x.x.x audit 1 1 0 Timestamp=Mar 23 2017 14:54:14.227 EDT,EntityName=m@m.com,Category=Guest User,Action=ADD,User=mabc

Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

What information are you looking for that’s not provided?

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

What information are you looking for that’s not provided?

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
mke
Occasional Contributor II
Posts: 11
Registered: ‎10-31-2016

Re: Clearpass Guest application logs into external server

All attribiutes you see there

Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass Guest application logs into external server

You won't get that via syslog.


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Search Airheads
Showing results for 
Search instead for 
Did you mean: