Security

Reply
Occasional Contributor I
Posts: 6
Registered: ‎02-21-2012

Writing alerts in Clearpass Insight

Hello,

 

I'm wondering if anyone out there has written any clever alerts in Clearpass Insight that they might be able to share.  I'm looking into beefing up our monitoring of our CPPM production deployment.

 

I'm specifically interested in monitoring the license usage as a percentage of the unique authentications allowed.  I'd like to know if we're at 85-90% of the 500/5k threshholds ideally, but definitely want an alert when we reach capacity.  I assume a warn/error log entry is thrown when this happens.  Anyone know what that looks like and whether or not it's something I can catch in Insight?

 

Thanks,

 

Jason

Aruba
Posts: 1,536
Registered: ‎06-12-2012

Re: Writing alerts in Clearpass Insight

As of today most use the system alerts built into the cluster wide settings. You can also set alerts in insight for system events. I don't belive you can do capacity alerts but I will check. You can also send all the information your looking for to a syslog server and you can create alerts in it. There is a slunk app built that will give you everything you listed.

https://ase.arubanetworks.com/solutions/id/70
Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Occasional Contributor I
Posts: 6
Registered: ‎02-21-2012

Re: Writing alerts in Clearpass Insight

Thanks, I do have the clusterwide alerts enabled and working.  Their somewhat noisy though (at the moment, at least) as I have them set to send out both warnings and errors.  I'll look into catching this in splunk, but the thing is I haven't seen any license related warnings yet, so right now I'm not sure I'll know what I'm looking for until it's too late.  That is, unless the splunk app has all that built in...

Aruba
Posts: 1,536
Registered: ‎06-12-2012

Re: Writing alerts in Clearpass Insight

Yes it does. :-) The guys did a great job of setting baseline matrix. There will be an event notification if you do hit your lic limit.

 

Screen Shot 2014-12-02 at 12.29.07 AM.png

 

Screen Shot 2014-12-02 at 12.30.47 AM.png

 

Screen Shot 2014-12-02 at 12.31.26 AM.png

 

Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Moderator
Posts: 470
Registered: ‎11-09-2012

Re: Writing alerts in Clearpass Insight

You can get the SPLUNK app for frre from here.....

 

https://apps.splunk.com/app/1895/

 

Also, to add, in our next release we will release a Private MIB that can be complied in to your favorite NMS to provide additional monitoring for ClearPass OID's to extend the management of ClearPass.


Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Search Airheads
Showing results for 
Search instead for 
Did you mean: