Security

 View Only
last person joined: 11 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Clearpass Syslog Export Filter

This thread has been viewed 11 times

  • 1.  Clearpass Syslog Export Filter

    Posted Jan 12, 2023 09:07 PM
    Hello! I'm changing Syslog export setting.

    My customer wants to send the Framed-IP-Address to the Logserver additionally, so I modified the settings as shown in the picture above.
    But when i added RADIUS.Acct-Framed-IP-Address, logs were not sent to Logserver.

    I removed RADIUS.Acct-Framed-IP-Address and the log was sent again.

    Clearpass version is 6.9.5

    Also, the log transmission interval is not constant, and it is sent at intervals between about 15 and 15 minutes.

    Does anyone have any idea why??


  • 2.  RE: Clearpass Syslog Export Filter

    Posted Jan 13, 2023 12:30 PM
    There is an issue with using Common fields and the Radius fields.  I have had a case open for a while.  I am still working with them.  They seem to need my logs, not sure why as it seems like it is not just me, but if you open a case you can reference defect CP-46942 ID

    For a workaround, you can try to use Insight logs if you have them.  

    Walt
    Original Message