Security

Reply
Contributor II

Search Clearpass Accounting for specific commands?

Is it possible to search accounting in clearpass to find commands run? 

Example, a port had a vlan changed and I want to know when that happened. 

Can I tell when that port changed without having to click through each item listed in accounting?

Guru Elite

Re: Search Clearpass Accounting for specific commands?

Assuming you’re talking about TACACS+ Command Accounting? You can run a TACACS+ report in Insight with the raw data and then search the CSV export.

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Contributor II

Re: Search Clearpass Accounting for specific commands?

Yes TACACS+ accounting. 

I did not have insight enabled on my cluster and running a report I don't seem to have any data. Does the insight database only collect information realtime? 

Also, the only Category I found mentioning Accounting was "Accounting - Bandwidth and Session"

Guru Elite

Re: Search Clearpass Accounting for specific commands?

Data is only sent to Insight when it is enabled.

The TACACS Authentication report with raw data included should include this data.

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: