- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: monitoring identity awareness
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
monitoring identity awareness
Hey checkmates
I would like to know if someone of you is using some sort of script or one liner to monitor the state of identity awareness through command like adlog a dc as an example if the count of events from a dc is equal to zero or something similar.
Thanks in advance
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
pep show user all
pep show pdp all
dpd conn pep
You can use pdp and pep command for monitoring and troubleshooting identity awareness.
There are many helpful sub commands. Run those commands in expert mode on the gateway.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
probably I was not clear enough , I would like to know if someone of you put something like that into a script that can be monitored via snmp that show a result like if in adlog a dc the count is equal to zero , in large env showing all user won't be enough
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have it displayed in a small dashboard as we have 3 IDCs in different parts of the world connected to multiple firewalls, so two most critical gateways are in the dashboard reporting two things - that connectivity to IDC is alive (new events are arriving) and total number of users. INT represents 41k chassis with 4 SGM blades each (green tick agaist IDC means that connection to IDC is handled by that specific SGM). EXT is a regular non-chassis gateway. Error seen below unfortunately is part of R76 code on chassis - occasionally it fails to respond to pep s p a command, so my script then reports Error. Code itself is a simple bash script that calls pdp conn adqa or pdp conn idc (depending on GW version) and then pep s p a. Nothing overly complicated
I'm actually planning to "upgrade" this to have all gateways included that run IA. But haven't got time to do it yet..
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks this give me something that I can work on with extend snmp or similar at least trying to clean some output for retrieving the filed Users
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yep, IA monitoring can be challenging (as it is not 100% stable, especially on R76 chassis). And having multiple VSXes and MDS.. I'm trying to pull this to one place so I can have a quick view of what's happening with IA across all GWs, all CMAs and all IDCs. Food for thought Royi Priov?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
indeed , about vsx can you extend snmp per vs too? not so experienced on vsx side.
Your dashboard seems pretty solid instead of this oneliner but seems to do the job at the moment at least
pep s p a |
awk
-F
" "
'{print $5}'
|
grep
-
v
time
|
sed
'/^$/d'
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's exactly what i do and then check if you have received new events in last two minutes comparing current time vs last event. That's how green tick is updated
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your help!
Dan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Kaspars,
Sorry to resurrect this old thread, but it still seems there is no good way to monitor IDC events.
I'm currently trying to achieve the same as the OP and yourself have done, a way to monitor the reception of IDC events on the gateway itself.
I can write a quick script that will fetch these values via SSH, but I'd prefer to perform this via SNMP. I've looked through the identityServer MIB(1.3.6.1.4.1.2620.1.38), but from here I'm only able to monitor the number of events being received on the collector machine itself.
So far, I'd like to avoid using SSH, but I keep coming back to it as it is the easiest approach. Is there no way around using SSH? I've considered several, such as using extended SNMP and a custom OID or by executing a script in the gateway itself (using cpd_sched_config) and sending the result back to the snmp manager), but I wonder if I should just bite the bullet and use SSH
To be clear, I would like to query the GW (or the IDC itself), for the same information showed, in the Gateways tab, under columns "Events in last hour" and "Last event send time
Let me know your inputs. Thanks!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found a way to do this without SNMP or SSH, by using the gaia_api run-script. You can run any expert command there, that includes pdp conn idc. Then I just need to handle it on the client side
I plan to release a nagios plugin that will monitor the events received on the firewall per IDC and alert if they drop or if one (or all) stop receiving events inside a threshold.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you get anywhere with this? I was headed down the same path and didn't want to recreate the wheel.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I do have some code that runs the pdp idc conn command via API, but I didn't get to the processing part (not much time available to work on this). I'd be willing to share that if you'd like.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all,
Does anyone knows the oid in order to monitor the value of pep users (100) from the below table?
pep show pdp all
Command: root->show->pdp->all
---------------------------------------------------------------------------
| Direction | IP | ID | Status | Users | Connect time |
---------------------------------------------------------------------------
| Incoming | w.z.y.x | 0 | Connected | 39 |-------------------- |
---------------------------------------------------------------------------
| Incoming | x.y.z.w | 0 | Connected | 100 | ------------------- |
---------------------------------------------------------------------------
| Outgoing | x.y.z.w | 0 | Connected | N/A | -----------------|
---------------------------------------------------------------------------
BR,
Kostas