One Identity Safeguard for Privileged Sessions 6.9.2

SPS continuously monitors a number of parameters of the SPS hardware and its environment. If a parameter reaches a critical level (set in its respective Maximum field), SPS sends e-mail or SNMP messages to alert the administrator.

Figure 57: Basic Settings > Alerting & Monitoring — Health monitoring

Disk utilization maximum: Ratio of free space available on the hard disk. SPS sends an alert if the audit trails use more space than the set value. Archive the audit trails to a backup server to free disk space. For details, see Archiving and cleanup.

NOTE: The alert message includes the actual disk usage, not the limit set on the web interface. For example, you set SPS to alert if the disk usage increases above 10 percent. If the disk usage of SPS increases above this limit (for example to 17 percent), you receive the following alert message: less than 90% free (= 17%). This means that the amount of used disk space increased above 10% (what you set as a limit, so it is less than 90%), namely to 17%.
Load average: The average load of SPS during the last one, five, or 15 minutes.
Swap utilization maximum: Ratio of the swap space used by SPS. SPS sends an alert if it uses more swap space than the set value.

Preventing disk space fill-up

Basic settings > Configuring system monitoring on SPS > Preventing disk space fill-up

The following describes how to prevent disk space from filling up.

NOTE: One Identity highly recommends this if One Identity Safeguard for Privileged Sessions (SPS) is hosted in a virtual environment.

To prevent disk space from filling up

Navigate to Basic Settings > Management > Disk space fill-up prevention.

Figure 58: Basic Settings > Management > Disk space fill-up prevention — Preventing disk space fill-up
Enter the limit of maximum disk utilization in percents in the Disconnect clients when disks are: x percent used field. Make sure to enter a value between 50-98 percent. When disk space is used above the configured limit, SPS disconnects all clients. The default value is 80.
(Optional) To automatically start all configured archiving/cleanup jobs when disk usage goes over the limit, select the Automatically start archiving option.

For more information on configuring an archiving policy, see Archiving and cleanup.

NOTE: If there is no archiving policy configured, selecting this option will not trigger automatic archiving.
Click .
Navigate to Basic Settings > Alerting & Monitoring > Health monitoring and enable alert Disk utilization maximum.
Click .

System related traps

Basic settings > Configuring system monitoring on SPS > System related traps

SPS can send the following system related alerts in e-mail or as SNMP trap. To configure these alerts, see Configuring e-mail alerts and Configuring SNMP alerts.

NOTE:

Configure Disk space fill-up prevention, and configure SPS to send an alert if the free space on the disks of SPS is low. For details, see "Preventing disk space fill-up" in the Administration Guide.

Configure SPS to send an alert if a user fails to login to SPS. For details, see the Login failed alert in "System related traps" in the Administration Guide.

Figure 59: Basic Settings > Alerting & Monitoring — health monitoring

Table 1: System related traps
Name	SNMP alert ID	Description
Login failed	xcbLoginFailure	Failed login attempts from SPS web interface.
Successful login	xcbLogin	Successful login attempts into SPS web interface.
Logout from the management interface	xcbLogout	Logouts from SPS web interface.
Configuration changed	xcbConfigChange	Any modification of SPS's configuration.
General alert	xcbAlert	General alerts and error messages occurring on SPS. Note that alerts on general alerts and errors are sent whenever there is an alert or error level message in the SPS system log. These messages are very verbose and mainly useful only for debugging purposes. Enabling these alerts may result in multiple e-mails or SNMP traps sent about the same event.
General error	xcbError
Data and configuration backup failed	xcbBackupFailed	Alerts if the backup procedure is unsuccessful.
Data archiving failed	xcbArchiveFailed	Alerts if the archiving procedure is unsuccessful.
Database error occurred	xcbDBError	An error occurred in the database where SPS stores the connection metadata. For assistance, contact our Support Team.
License limit reached	xcbLimitReached	The number of protected servers (or concurrent sessions) reached the limit set in the SPS license. Clients cannot connect to new servers using SPS.
HA node state changed	xcbHaNodeChanged	A node of the SPS cluster changed its state (for example, a takeover occurred).
Timestamping error occurred	xcbTimestampError	An error occurred during the timestaming process (for example, the timestamping server did not respond).
Time sync lost	xcbTimeSyncLost	The system time became out of sync.
Raid status changed	xcbRaidStatus	The status of the node's RAID device changed its state.
Hardware error occurred	xcbHWError	SPS detected a hardware error.
Firmware error occured	xcbFirmwareError	SPS detected a firmware error, which can be as follows: Corrupted: The firmware integrity check failed. If a firmware is shown as corrupted, contact our Support Team. Tainted: It indicates that you have modified a file of the firmware locally. If you have modified a local file unintentionally, contact our Support Team.
Too many login attempts	xcbBruteforceAttempt	SPS has detected a possible brute-force attack.
License expires soon	xcbLicenseAlmostExpired	Your SPS license will expire within 60 days.
A system service failed	xcbInitSystemUnitFailed	A system service has failed. Note that one alert is sent for each failed service.
Random generator error occurred	xcbRandomGeneratorError	The random generator repeatedly created the same byte sequence. To fix this issue, you can restart your SPS. If the error persists, contact our Support Team.

Traffic related traps

Basic settings > Configuring system monitoring on SPS > Traffic related traps

SPS can send the following traffic related alerts in e-mail or as SNMP trap. To configure these alerts, see Configuring e-mail alerts and Configuring SNMP alerts.

Figure 60: Basic Settings > Alerting & Monitoring — health monitoring

Table 2: Traffic related traps
Name	SNMP alert ID	Description
Channel opening denied	scbChannelDenied	A user attempted to open a channel not permitted by the channel policy.
Connection denied	scbConnectionDenied	A user attempted to connect a server not permitted in the connection policies.
User successfully authenticated	scbAuthSuccess	A user successfully authenticated on a protected server.
User authentication failed	scbAuthFailure	A user failed to complete the authentication on a protected server.
SSH host key mismatch	scbSshHostKeyMismatch	The SSH host key of a server did not match the key stored on SPS.
New SSH host key learned	scbHostKeyLearned	SPS learned a new SSH host key.
Connection timed out	scbConnectionTimedout	A connection to a protected server timed out.
Protocol violation	scbProtocolViolation	A connection violated the protocol as specified in the RFC or protocol documentation. This may have been caused by an incompatible application or a deliberate attack.
Connection to the server failed	scbConnectionFailed	A connection to a protected server failed.
User successfully authenticated on the gateway	scbGWAuthSuccess	A user has successfully authenticated a connection on SPS as part of a gateway-authentication process.
User authentication failed on the gateway	scbGWAuthFailure	The gateway-authentication of a connection has failed.
User mapping failed on the gateway	scbUserMappingFailure	A usermapping policy did not find a suitable mapping for the connection.
Decryption of a credential store failed	scbCredStoreDecrpytError	SPS could not unlock a password-protected Credential Store. Navigate to Unlock Credential Store and enter the password(s) to open the Credential Store.
The requested credential store is closed	scbCredStoreClosed	A user attempted to access a connection policy that uses a password-protected Credential Store, and the Credential Store has not been unlocked. Navigate to Unlock Credential Store and enter the password(s) to open the Credential Store.
Failed to unlock credential store	scbCredStoreUnlockFailure	A user attempted to unlock a password-protected Credential Store with an incorrect password. Navigate to Unlock Credential Store and enter the correct password(s) to open the Credential Store.
Real time audit event detected	scbRealTimeAlert	A real-time audit event has occurred.
AMQP error occurred	scbAMQPError	An error occurred in the event queue where SPS forwards session data. contact our Support Team.

제품을 선택하십시오.

더 나은 서비스 제공을 위해 채팅 목적을 작성해 주십시오.

문제에 대한 권장 솔루션

One Identity Safeguard for Privileged Sessions 6.9.2 - Administration Guide

Health monitoring

Preventing disk space fill-up

System related traps

Traffic related traps