ClearPass Syslog Export
07-29-2020 03:04 AM
Quick question. I have followed this guide to configure the export of ClearPass events to an external syslog server: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/syslogExportFilters.html%3FTocPath%3DAdministration%7C%2520External%2520Servers%7CSyslog%2520Export%2520Filters%7C_____0
However no logs are being sent.
Do I need to configure and enable the logging under Server Manager> Log configuration and then tick the boxes to enable syslog and enter my syslog server details here also or is this for non-filtered logging?
Re: ClearPass Syslog Export
07-29-2020 09:27 AM
its not necessary , by configuring the Syslog Target and Correct filter should work.
By configuring in Log configuration > Syslog server you can specify the default log level for each service and its associated modules based on DEBUGGING requirement.
Please make sure UDP or TCP ( as per configured in syslog target) port 514 is open between ClearPass and Syslog server.
Or else work with TAC for faster resolution.
NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.