Syslog - Aruba Clear Pass (2024)

Device Details

Prerequisites

• Access to Aruba Clear Pass platform.
• Port 514 TCP/UDP allowed from Aruba Clear Pass to LogRhythm System Monitor Agent.
• Port 514 TCP/UDP allowed on LogRhythm System Monitor Agent to receive syslog packets from Aruba Clear Pass.
• LogRhythm Global Admins or Restricted Admins with elevated View and Manage privileges.

Configure Aruba Clear Pass

Add a Syslog Target

To add a syslog target:

1. Click Administration, and then External Servers.
2. Click Syslog Targets.
   The Syslog Targets page opens.
3. Click Add.
   TheAdd Syslog Targetdialog opens.

4. Specify the following Add Syslog Target parameters:

   Parameter	Description
   Host Address	Enter the syslog server hostname or IP address.
   Description	Enter a short description of the syslog server.
   Protocol	Select either TCP or UDP.
   Server Port	The default port number is 514.

   See Also

   How to Configure Syslog on a Cisco DeviceHow to Configure Syslog Server in Windows?Configuring an External Syslog Server
5. Click Save.
   The new Syslog Target is added to the list.

Add a Syslog Export Filter

To add a syslog export filter:

1. Click Administration, and thenExternal Servers.
2. Click Syslog Export Filters.
3. Click Add.
   The Add Syslog Filterspage opens to theGeneraltab.

4. Specify the following:

   Parameter	Description
   Name	Name of the syslog export filter.
   Description	Enter a short description for the syslog export filter.
   Export Event Format Type	SelectStandardto use the default event format.
   Syslog Servers	Define the receivers of syslog messages using theSelect to Adddrop-list.

5. ClickSave.

Configure LogRhythm

Only Global Admins or Restricted Admins with elevated View and Manage privileges can take these actions.

Confirm the Syslog Server is Enabled

1. In the Client Console on the main toolbar, clickDeployment Manager.
2. Click theSystem Monitorstab.
3. Double-click the System Monitor Agent that collects the logs.
   The System Monitor Agent Properties dialog box appears.
4. Click theSyslog and Flow Settingstab.
5. Click theEnable Syslog Servercheck box.
6. ClickOK.

Restart the LogRhythm System Monitor Service

1. On the System Monitor Agent host, right-click the Windows Startmenu, and then clickRun.
   The Run dialog box appears.
2. In the Open field, enterservices.msc, and then click OK.
   The Services console appears.
3. Right-click LogRhythm System Monitor Service, and then clickRestart.

Verify the System Monitor Agent is Connected

After restarting the LogRhythm System Monitor Service, you need to verify that the Agent is listening for the TCP/UDP connection on default port 514.

1. On the System Monitor Agent host, right-click the Windows Startmenu, and then clickCommand Prompt.
   The Command Prompt dialog box appears.

2. Execute the following command:

   POWERSHELL

   netstat -ano | findstr :514

   Example of expected output:
   

   

   
   

Configure LogRhythm to Collect Logs

Resolve Log Source Hosts

1. On the main toolbar, clickDeployment Manager.
2. Click theLog Sourcestab.
3. In the New Log Sources grid, select theActioncheck box of the Syslog – Aruba Clear Pass log source.
4. Right-click the selection, clickActions, and then clickResolve Log Source Hosts.
   The Resolve Known Hosts Complete dialog box appears.
5. ClickOK.

Confirm Log Source Acceptance Properties

1. On the main toolbar, clickDeployment Manager.
2. Click theLog Sourcestab.
3. In the New Log Sources grid, select theActioncheck box of the Syslog – Aruba Clear Pass log source.
4. Right-click the selection,and then clickProperties.
   The Log Source Acceptance Properties dialog box appears.
5. Confirm the Device IP Address matches the IP address of the Aruba Clear Pass device.
6. (Optional)Change the Log Source Name, if desired.
7. To the right of the Log Source Type field, click the...selector.
   The Log Source Type Selector dialog box appears.
8. In the Text Filter field, enterSyslog – Aruba Clear Pass, and then clickApply.
9. In the Log Source Type section, clickSystem : Syslog - Aruba Clear Pass, and then clickOK.
   The Log Source Acceptance Properties dialog box appears.
10. Click the field under MPE Policy, and then clickLogRhythm Default.
11. ClickOK.

Accept the New Log Source

1. On the main toolbar, clickDeployment Manager.
2. Click theLog Sourcestab.
3. In the New Log Sources grid, select theActioncheck box of the Syslog – Aruba Clear Pass.
4. Right-click the selection, clickActions, clickAccept, and then clickDefaults.
   The Accept Successful dialog box appears.
5. ClickOK.
   The Syslog – Aruba Clear Pass Log source moves from the New Log Sources list to the existing list in at the bottom of the screen.

Tail the Log Source

1. On the main toolbar, clickDeployment Manager.
2. Click theLog Sourcestab.
3. In the grid below the New Log Sources grid, select theActioncheck box of the Syslog – Aruba Clear Pass log source.
4. Right-click the selection, clickActions, and then clickTail Log Source(s).