Security

Upcoming community maintenance Oct. 27th through Oct. 29th
For more info click here
Reply
Highlighted
MVP

ClearPass Syslog Export

Hi,


Quick question.  I have followed this guide to configure the export of ClearPass events to an external syslog server: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/syslogExportFilters.html%3FTocPath%3DAdministration%7C%2520External%2520Servers%7CSyslog%2520Export%2520Filters%7C_____0


However no logs are being sent. 


Do I need to configure and enable the logging under Server Manager> Log configuration and then tick the boxes to enable syslog and enter my syslog server details here also or is this for non-filtered logging?

 

Thanks

Highlighted
Contributor II

Re: ClearPass Syslog Export

Hi Scottm.

 

its not necessary , by configuring the Syslog Target and Correct filter should work.

 

By configuring in Log configuration > Syslog server you can specify the default log level for each service and its associated modules based on DEBUGGING requirement. 

 

Please make sure UDP or TCP ( as per configured in syslog target) port 514 is open between ClearPass and Syslog server.

 

Or else work with TAC for faster resolution.

 

 

 

Vikram Sonawane | ACCP | @Vikram_Sonawane


NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Highlighted
MVP

Re: ClearPass Syslog Export

I got it working after changing the export syslog filter methods from Standard to CEF.

 

Thanks

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: