Cisco Acs 5x User Guide
Have a look at the manual Cisco Acs 5x User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
12-23 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 ACS Process Status When ACS evaluates this threshold, it examines the accounting records that it received during the interval between the previous and current alarm evaluation cycle. If one or more accounting records match, it calculates the time that has lapsed since the previous alarm evaluation cycle. When it reaches two, three, or five minutes depending on the number of active thresholds, ACS determines whether any ACS process has failed during that time. If ACS detects one or more failures, an alarm is triggered. You can limit the check to particular processes or a particular ACS instance or both. Choose this category to define threshold criteria based on ACS process status. Modify the fields in the Criteria tab as described in Table 12-17. Table 12-16 ACS System Diagnostics Option Description Severity at and above Use the drop-down list box to choose the severity level on which you want to configure your threshold. This setting captures the indicated severity level and those that are higher within the threshold. Valid options are: Fatal Error Wa r n i n g Info Debug Message Text Enter the message text on which you want to configure your threshold. Maximum character limit is 1024. Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Table 12-17 ACS Process Status Option Description Monitor Processes ACS Database Check the check box to add the ACS database to your threshold configuration. ACS Management Check the check box to add the ACS management to your threshold configuration. ACS Runtime Check the check box to add the ACS runtime to your threshold configuration. Monitoring and Reporting Database Check the check box to have this process monitored. If this process goes down, an alarm is generated.
12-24 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 ACS System Health When ACS evaluates this threshold, it examines whether any system health parameters have exceeded the specified threshold in the specified time interval up to the previous 60 minutes. These health parameters include percentage of CPU utilization, percentage of memory consumption, and so on. If any of the parameters exceed the specified threshold, an alarm is triggered. By default, the threshold applies to all ACS instances in your deployment. If you want, you can limit the check to just a single ACS instance. Choose this category to define threshold criteria based on the system health of ACS. Modify the fields in the Criteria tab as described in Table 12-18. Monitoring and Reporting Collector Check the check box to have this process monitored. If this process goes down, an alarm is generated. Monitoring and Reporting Alarm Manager Check the check box to have this process monitored. If this process goes down, an alarm is generated. Monitoring and Reporting Job Manager Check the check box to have this process monitored. If this process goes down, an alarm is generated. Monitoring and Reporting Log Processor Check the check box to have this process monitored. If this process goes down, an alarm is generated. Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Table 12-17 ACS Process Status Option Description Table 12-18 ACS System Health Option Description Average over the past Use the drop-down list box to select the amount of time you want to configure for your configuration, where is minutes and can be: 15 30 45 60 CPU Enter the percentage of CPU usage you want to set for your threshold configuration. The valid range is from 1 to 100. Memory Enter the percentage of memory usage (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100.
12-25 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 ACS AAA Health When ACS evaluates this threshold, it examines whether any ACS health parameters have exceeded the specified threshold in the specified time interval up to the previous 60 minutes. ACS monitors the following parameters: RADIUS Throughput TACACS Throughput RADIUS Latency TA C A C S L a t e n c y If any of the parameters exceed the specified threshold, an alarm is triggered. By default, the threshold applies to all monitored ACS instances in your deployment. If you want, you can limit the check to just a single ACS instance. Modify the fields in the Criteria tab as described in Table 12-19. Disk I/O Enter the percentage of disk usage you want to set (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100. Disk Space Used/opt Enter the percentage of /opt disk space usage you want to set (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100. Disk Space Used/local disk Enter the percentage of local disk space usage you want to set (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100. Disk Space Used/ Enter the percentage of the / disk space usage you want to set (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100. Disk Space Used/tmp Enter the percentage of temporary disk space usage you want to set (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 100. Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Table 12-18 ACS System Health Option Description
12-26 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 RADIUS Sessions When ACS evaluates this threshold, it determines whether any authenticated RADIUS sessions have occurred in the past 15 minutes where an accounting start event has not been received for the session. These events are grouped by device IP address, and if the count of occurrences for any device IP exceeds the specified threshold, an alarm is triggered. You can set a filter to limit the evaluation to a single device IP. Choose this category to define threshold criteria based on RADIUS sessions. Modify the fields in the Criteria tab as described in Table 12-20. Table 12-19 ACS AAA Health Option Description Average over the past Use the drop-down list box to select the amount of time you want to configure for your configuration, where is minutes and can be: 15 30 45 60 RADIUS Throughput Enter the number of RADIUS transactions per second you want to set (lesser than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 999999. TACACS Throughput Enter the number of TACACS+ transactions per second you want to set (lesser than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 999999. RADIUS Latency Enter the number in milliseconds you want to set for RADIUS latency (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 999999. TACACS Latency Enter the number in milliseconds you want to set for TACACS+ latency (greater than or equal to the specified value) for your threshold configuration. The valid range is from 1 to 999999. Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold.
12-27 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Unknown NAD When ACS evaluates this threshold, it examines the RADIUS or TACACS+ failed authentications that have occurred during the specified time interval up to the previous 24 hours. From these failed authentications, ACS identifies those with the failure reason Unknown NAD. The unknown network access device (NAD) authentication records are grouped by a common attribute, such as ACS instance, user, and so on, and a count of the records within each of those groups is computed. If the count of records for any group exceeds the specified threshold, an alarm is triggered. This can happen if, for example, you configure a threshold as follows: Unknown NAD count greater than 5 in the past 1 hour for a Device IP If in the past hour, failed authentications with an unknown NAD failure reason have occurred for two different device IP addresses as shown in the following table, an alarm is triggered, because at least one device IP address has a count greater than 5. You can specify one or more filters to limit the failed authentications that are considered for threshold evaluation. Each filter is associated with a particular attribute in the records and only those records that match the filter condition are counted. If you specify multiple filter values, only the records that match all the filter conditions are counted. Choose this category to define threshold criteria based on authentications that have failed because of an unknown NAD. Modify the fields in the Criteria tab as described in Table 12-21. Table 12-20 RADIUS Sessions Option Description More than num authenticated sessions in the past 15 minutes, where accounting start event has not been received for a Device IPnum—A count of authenticated sessions in the past 15 minutes. Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Device IP Click Select to choose or enter a valid device IP address on which to configure your threshold. Device IP Count of Unknown NAD Authentication Records a.b.c.d 6 e.f.g.h 1
12-28 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 External DB Unavailable When ACS evaluates this threshold, it examines the RADIUS or TACACS+ failed authentications that have occurred during the specified interval up to the previous 24 hours. From these failed authentications, ACS identifies those with the failure reason, External DB unavailable. Authentication records with this failure reason are grouped by a common attribute, such as ACS instance, user, and so on, and a count of the records within each of those groups is computed. If the count of records for any group exceeds the specified threshold, an alarm is triggered. This can happen if, for example, you configure a threshold as follows: External DB Unavailable count greater than 5 in the past one hour for a Device IP If in the past hour, failed authentications with an External DB Unavailable failure reason have occurred for two different device IP addresses as shown in the following table, an alarm is triggered, because at least one device IP address has a count greater than 5. Table 12-21 Unknown NAD Option Description Unknown NAD count greater than num in the past time Minutes|Hours for a object, where: num values can be any five-digit number greater than or equal to zero (0). time values can be 1 to 1440 minutes, or 1 to 24 hours. Minutes|Hours value can be Minutes or Hours. object values can be: –ACS Instance –Device IP Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Device IP Click Select to choose or enter a valid device IP address on which to configure your threshold. Protocol Use the drop-down list box to configure the protocol that you want to use for your threshold. Valid options are: RADIUS TA C A C S + Device IP Count of External DB Unavailable Authentication Records a.b.c.d 6 e.f.g.h 1
12-29 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds You can specify one or more filters to limit the failed authentications that are considered for threshold evaluation. Each filter is associated with a particular attribute in the records and only those records that match the filter condition are counted. If you specify multiple filter values, only the records that match all the filter conditions are counted. Choose this category to define threshold criteria based on an external database that ACS is unable to connect to. Modify the fields in the Criteria tab as described in Table 12-22. Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 RBACL Drops When ACS evaluates this threshold, it examines Cisco Security Group Access RBACL drops that occurred during the specified interval up to the previous 24 hours. The RBACL drop records are grouped by a particular common attribute, such as NAD, SGT, and so on. A count of such records within each of those groups is computed. If the count for any group exceeds the specified threshold, an alarm is triggered. For example, consider the following threshold configuration: RBACL Drops greater than 10 in the past 4 hours by a SGT. Table 12-22 External DB Unavailable Option Description External DB Unavailablepercent|count greater than num in the past time Minutes|Hours for a object, where: Percent|Count value can be Percent or Count. num values can be any one of the following: –0 to 99 for percent –0 to 99999 for count time values can be 1 to 1440 minutes, or 1 to 24 hours. Minutes|Hours value can be Minutes or Hours. object values can be: –ACS Instance –Identity Store Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Identity Group Click Select to choose a valid identity group name on which to configure your threshold. Identity Store Click Select to choose a valid identity store name on which to configure your threshold. Access Service Click Select to choose a valid access service name on which to configure your threshold. Protocol Use the drop-down list box to configure the protocol that you want to use for your threshold. Valid options are: RADIUS TA C A C S +
12-30 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds If, in the past four hours, RBACL drops have occurred for two different source group tags as shown in the following table, an alarm is triggered, because at least one SGT has a count greater than 10. You can specify one or more filters to limit the RBACL drop records that are considered for threshold evaluation. Each filter is associated with a particular attribute in the RBACL drop records and only those records that match the filter condition are counted. If you specify multiple filter values, only the records that match all the filter conditions are counted. Modify the fields in the Criteria tab as described in Table 12-23. Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 SGT Count of RBACL Drops 117 314 Table 12-23 RBACL Drops Option Description RBACL drops greater than num in the past time Minutes|Hours by a object, where: num values can be any five-digit number greater than or equal to zero (0). time values can be 1 to 1440 minutes, or 1 to 24 hours. Minutes|Hours value can be Minutes or Hours. object values can be: –NAD –SGT –DGT –DST_IP Filter Device IP Click Select to choose or enter a valid device IP address on which to configure your threshold. SGT Click Select to choose or enter a valid source group tag on which to configure your threshold. DGT Click Select to choose or enter a valid destination group tag on which to configure your threshold. Destination IP Click Select to choose or enter a valid destination IP address on which to configure your threshold.
12-31 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds NAD-Reported AAA Downtime When ACS evaluates this threshold, it examines the NAD-reported AAA down events that occurred during the specified interval up to the previous 24 hours. The AAA down records are grouped by a particular common attribute, such as device IP address or device group, and a count of records within each of those groups is computed. If the count for any group exceeds the specified threshold, an alarm is triggered. For example, consider the following threshold configuration: AAA Down count greater than 10 in the past 4 hours by a Device IP If, in the past four hours, NAD-reported AAA down events have occurred for three different device IP addresses as shown in the following table, an alarm is triggered, because at least one device IP address has a count greater than 10. You can specify one or more filters to limit the AAA down records that are considered for threshold evaluation. Each filter is associated with a particular attribute in the AAA down records and only those records that match the filter condition are counted. If you specify multiple filter values, only the records that match all the filter conditions are counted. Choose this category to define threshold criteria based on the AAA downtime that a network access device reports. Modify the fields in the Criteria tab as described in Table 12-24. Device IP Count of NAD-Reported AAA Down Events a.b.c.d 15 e.f.g.h 3 i.j.k.l 9 Table 12-24 NAD-Reported AAA Downtime Option Description AAA down greater than num in the past time Minutes|Hours by a object, where: num values can be any five-digit number greater than or equal to zero (0). time values can be 1 to 1440 minutes, or 1to 24 hours. Minutes|Hours value can be Minutes or Hours. object values can be: –Device IP –Device Group
12-32 User Guide for Cisco Secure Access Control System 5.3 OL-24201-01 Chapter 12 Managing Alarms Creating, Editing, and Duplicating Alarm Thresholds Related Topics Creating, Editing, and Duplicating Alarm Thresholds, page 12-11 Configuring General Threshold Information, page 12-13 Configuring Threshold Notifications, page 12-32 Configuring Threshold Notifications Use this page to configure alarm threshold notifications. Step 1Select Monitoring and Reports > Alarms > Thresholds, then do one of the following: Click Create to create a new alarm threshold. Click the name of an alarm threshold, or check the check box next to an existing alarm threshold and click Edit to edit a selected alarm threshold. Click the name of an alarm threshold, or check the check box next to an existing alarm threshold and click Duplicate to duplicate a selected alarm threshold. Step 2Click the Notifications tab. The Thresholds: Notifications page appears as described in Table 12-25: Filter ACS Instance Click Select to choose a valid ACS instance on which to configure your threshold. Device IP Click Select to choose or enter a valid device IP address on which to configure your threshold. Device Group Click Select to choose a valid device group name on which to configure your threshold. Table 12-24 NAD-Reported AAA Downtime Option Description Table 12-25 Thresholds: Notifications Page Option Description Severity Use the drop-down list box to select the severity level for your alarm threshold. Valid options are: Critical Wa r n i n g Info Send Duplicate NotificationsCheck the check box to be notified of duplicate alarms. An alarm is considered a duplicate if a previously generated alarm for the same threshold occurred within the time window specified for the current alarm.