Monitoring

Ignore the colors. Splunk picks the colors, so red might mean accept or some other nonsense. Make sure you look at the legend.

eduroam

eduroam splunk dashboard

Row 1

• Overall distribution of requests.
• This is sourced from the authentication servers.
• Time selected from the “Recent time” picker.

Row 2

• Outcome ratios broken down by cluster
• Sourced from the authentication servers (FreeRADIUS).
• Time selected from the “Recent time” picker.
• Timestamps of these logs are based on when the server has a response prepared to send, not when it is actually sent. Notably, rejects get a 1s delay (by design).

Row 3

• Outcome ratios broken down by cluster.
• Sourced from the controllers.
• Time selected from the “Recent time” picker.
• A reject log is generated from the dot1x-proc process.
• An accept log is generated from the authmgr process.
  • log generated when an entry is added to the user table
  • log per IP address, not per authentication request.
  • Typically 3-4 times as many accepts compared to row 2.
• A device that gets an accept, but is unable to get an IP address is not logged from the controller’s perspective.

Row 4

• Top talkers
• Sourced from the authentication servers.
• Time selected from the “Top time” picker.

ClearPass (CPPM)

ClearPass splunk dashboard

• Due to MAC auth, it is normal for there to be far more rejects than accepts.
• Extraordinarily few rejects are actually sent. Instead devices are “rejected” by not assigning a role.
• Web auth happens after the user gets an IP address.

Left column

• Outcome ratios broken down by cluster.
• Sourced from the controllers.

Right column

• Outcome ratios broken down by cluster.
• Sourced from the authentication servers (CPPM).
• For more details on recent events, check the access tracker in CPPM.