Tags that start with nac.aruba identify all log events generated by Aruba Networks ClearPass and Aruba OS.
For information about ClearPass, see the vendor website.
The full nac.aruba tags have four levels. The first two are fixed as nac.aruba. The third level identifies the service type and must be one of cppm (for ClearPass Policy Manager events) or os (for Aruba OS events). The fourth level of the tag identifies the event type.
These are the valid tags and the types of events that correspond to each:
|Tag/table name||Event types*|
|nac.aruba.os.events||Aruba OS log events|
* As the names of the event types can be customized for each installation, the event type names in this table are meant for guidance only.
When the events are delivered to Devo, they will be accessible in the Finder in tables of the same names.
For more information, read more about Devo tags.
Step 1: Set up the Devo relay rules
You will need to set up five rules on the relay to correctly process and forward the events received from ClearPass. It is important that the rules follow the order indicated here, otherwise, events may not be correctly tagged.
In the examples below, we use port 13010 but you should use any port that you can dedicate to these events. We also use the event type names as listed earlier in this article. You should specify Source Message values that reflect the event type names used in your installation.
Rule 1: ClearPass Endpoint Profile events
Rule 2: ClearPass System Event events
Rule 3: ClearPass System Stat events
Rule 4: ClearPass Policy events
Rule 5: Aruba OS events
Step 2: Set up ClearPass to forward events to the Devo relay
Set up the Devo relay as a Syslog Target in ClearPass. Be sure to use TCP as the protocol and to specify the port on which you set up the relay rules.
Next, set up the Syslog Export Filter in ClearPass that will forward data to the Devo relay.