Identity Collector Stats in Smart Monitoring: GW upgrade from R80.10 to R80.30

[Scott_Chambers]

I've got a question regarding the monitoring capability for the Identity collector as listed in sk108235.

We have 2 GW clusters that were R80.10 and had IA collectors connected to them; Those GWs then shared to our other GWs via identity sharing.

On the 2 IA connected GWs when on R80.10, we were able to see the machine and user accounts in the monitor section under Identity awareness.   The general Info section listed the total logged in identities and when clicking 'more', we saw the "identity Collector (Active Directory)" name filled with User, machine, and totals.   

We have upgraded one of the 2 IA collector connected GWs and we have lost all of these monitoring stats on such GW.

I believe that is due to the new monitoring capabilities via the regedits on the IA collector machines not enabled as per the SK.     

Question:

1) Does that sound accurate?

2) Is there any ill affect to the R80.10 IA GW if I enable this monitoring or do i have to wait for both of them to be at R80.20 or higher (i.e. after we upgrade the last one to R80.30)?  

Thanks in advance 🙂 

[PhoneBoy]

Seems reasonable to me.
@Royi_Priov can you comment on the R80.10 question here?

[Royi_Priov]

Hi @Scott_Chambers ,

• The monitoring you referred to in R80.10 is not related to the one in the SK. this monitoring is maintained generally by the PDP according to the session property. If the new upgraded GW doesn't present them (check 'cpstat identityServer -f logins' or on cpview->blades->IDA) please open ticket with TAC.
• If a gw which is not R80.20 and above will receive the new monitoring feature, it will just drop it as he is not familiar with such message.

[Scott_Chambers]

Thank you Royi.

The new 80.30 gateways does NOT provide any output to 'cpstat identityServer -f logins'.

[Expert@Upgraded_GW_80.30:0]# cpstat identityServer -f logins

CaptivePortal: 0
AD Query: 0
Agent: 0
Terminal Server: 0
RADIUS Accounting: 0
Remote Access: 0
Identity Collector [Active Directory]: 0
Identity Collector [Cisco ISE]: 0
Identity Collector [Syslog]: 0
Identity Collector [eDirectory]: 0
Identity Awareness API: 0
Users With Anti-Spoofing Protection: 0
Successful User Logins [Kerberos]: 0
Successful Machine Logins [Kerberos]: 0
Successful User Logins [User name and password]: 0
Successful User Logins [AD Query]: 0
Successful Machine Logins [AD Query]: 0
Unsuccessful User Logins [Kerberos]: 0
Unsuccessful Machine Logins [Kerberos]: 0
Unsuccessful User Logins [User name and password]: 0

[Expert@Upgraded_GW_80.30:0]#

I'll have our case updated accordingly as a fallout to the upgrade. On the 2nd note, thank you. Once we get this reporting back properly, i'll update the regedit on the IA collectors per the SK knowing it will not affect the 80.10 GW

[Scott_Chambers]

Update:   We did update the IA collectors and we are able to get the new monitoring stats to work via "cpstat identityServer -f idc" and "pdp idc status".    

The outputs for "cpstat identityServer -f logins" still remain at zero.    Having our internal team escalate our TAC case now....

For the record, we are on R80.30  JHF take 196 .   The IA collectors are on 80.85.0000, which I know is a couple versions behind but I don't see anything on the bug list that matches this issue (sk134312).    

The version of the IA collector wouldn't not affect this stat output, correct?   I don't think so since we have our R80.10 gateway cluster outputting fine right now so if it was the collector, it would be OS version specific it looks like.