Event Viewer

The Event Viewer page provides reports about system-level events. All attempted upgrade, patch, and hotfix installations are logged in the Event Viewer, including failed system installation attempts. This page also displays information about licensing overruns (where license usage exceeds license availability). When the appliance falls within the allowed license limits again , the Event Viewer displays an updated message indicating that ClearPass has adequate licenses.

Session idle time-out values for Admin WebUI session time-out and CLI session time-out events generate Event Viewer messages with a description that includes the client IP address and session ID when necessary.

Export and import operations for all modules are captured in the Event Viewer. Any configuration items that can be imported or exported, such as services, enforcement profiles, endpoints, devices, and so on are logged.

Unsupported Admin Access Attempts Logged to the Event Viewer

If an attempt is made to access the ClearPassPolicy Manager administration command-line interface (CLI) with unsupported SSH protocol versions, or unsupported encryption or cryptographic hash algorithms, ClearPass logs those alerts in the Event Viewer. This feature requires the Ingress Event Engine option and services to be enabled (for details, see Enabling Ingress Events Processing).

If an attempt is made to access ClearPassPolicy Manager administration WebUI with unsupported SSL protocol versions, or unsupported ciphers, ClearPass logs those alerts in the Event Viewer. This feature requires the Ingress Event Engine option and services to be enabled for the ClearPass server (for details, see Enabling Ingress Events Processing).

To access the Event Viewer:

Navigate to > . The page opens.

Figure 1 Event Viewer Page

The following table describes the Event Viewer parameters:

Table 1: Event Viewer Page Parameters
Parameter	Description
Source	Displays the source of the event. For example, Policy Manager UI or ClearPassFirmware Update Checker.
Level	Displays the level of the event from the following options: INFO WARN ERROR
Category	Displays the category of the event. For example, Logged in, System, or AV/AS Updates.
Action	Displays the status of the event action. For example, Success, Failed, Unknown, and None.
Timestamp	Displays the date and time when the event occurred.

Creating an Event Viewer Report Using Custom Values

To create an Event Viewer report using custom values:

Click the

icon. A new is added. You can add up to four .

Figure 2 Adding an Event Viewer Filter

In the field, select the element on which you wish to filter:

Source

Level

Category

Action

Description

Specify or contains.

In the text field, enter the type of event for which you are searching.

(Optional) Create up to three additional filters if needed.

(Optional) Change the value as desired.

Click Go. The following figure displays the report with custom values:

Figure 3 Event Viewer Report with Customized Filter

The following table describes the System Event Details parameters:

Table 2: System Event Details Page Parameters
Parameter	Description
Source	Displays the source of the event. For example, Admin UI, RADIUS, and SnmpService.
Level	Displays the level of the event from the following options: INFO WARN ERROR
Category	Displays the category of the event. For example, Import, Export, Request, Authentication, and System.
Action	Displays the action of the events. For example, Success, Failed, Unknown, and None.
Timestamp	Displays the date and time when the event occurred.
Description	Displays additional information about the event, including User, Role, Entity, Client IP Address, summary of the event, and when pertinent, the session inactive expiry time.