The following describes how to configure monitoring.
To configure monitoring
Navigate to Basic Settings > Alerting & Monitoring.
The default threshold values of the parameters are suitable for most situations. Adjust the threshold values only if needed.
Navigate to Basic Settings > Management and verify that the SNMP settings and Mail settings of SPS are correct. SPS sends alerts only to the alert e-mail address and to the SNMP server.
Sending alerts fails if these settings are incorrect.
The following sections describe the parameters you can receive alerts on.
For details on health-monitoring alerts, see Health monitoring.
For details on system-monitoring alerts, see System related traps.
For details on traffic-monitoring alerts, see Traffic related traps.
SPS continuously monitors a number of parameters of the SPS hardware and its environment. If a parameter reaches a critical level (set in its respective Maximum field), SPS sends e-mail or SNMP messages to alert the administrator.
Figure 53: Basic Settings > Alerting & Monitoring — Health monitoring
Disk utilization maximum: Ratio of free space available on the hard disk. SPS sends an alert if the audit trails use more space than the set value. Archive the audit trails to a backup server to free disk space. For details, see Archiving and cleanup.
The alert message includes the actual disk usage, not the limit set on the web interface. For example, you set SPS to alert if the disk usage increases above 10 percent. If the disk usage of SPS increases above this limit (for example to 17 percent), you receive the following alert message: less than 90% free (= 17%). This means that the amount of used disk space increased above 10% (what you set as a limit, so it is less than 90%), namely to 17%.
Load average: The average load of SPS during the last one, five, or 15 minutes.
Swap utilization maximum: Ratio of the swap space used by SPS. SPS sends an alert if it uses more swap space than the set value.
The following describes how to prevent disk space from filling up.
One Identity highly recommends this if One Identity Safeguard for Privileged Sessions (SPS) is hosted in a virtual environment.
To prevent disk space from filling up
Navigate to Basic Settings > Management > Disk space fill-up prevention.
Figure 54: Basic Settings > Management > Disk space fill-up prevention — Preventing disk space fill-up
Enter the limit of maximum disk utilization in percents in the Disconnect clients when disks are: x percent used field. Make sure to enter a value between 50-98 percent. When disk space is used above the configured limit, SPS disconnects all clients. The default value is 80.
(Optional) To automatically start all configured archiving/cleanup jobs when disk usage goes over the limit, select the Automatically start archiving option.
For more information on configuring an archiving policy, see Archiving and cleanup.
If there is no archiving policy configured, selecting this option will not trigger automatic archiving.
Navigate to Basic Settings > Alerting & Monitoring > Health monitoring and enable alert Disk utilization maximum.
Configure Disk space fill-up prevention, and configure SPS to send an alert if the free space on the disks of SPS is low. For details, see "Preventing disk space fill-up" in the Administration Guide.
Configure SPS to send an alert if a user fails to login to SPS. For details, see the Login failed alert in "System related traps" in the Administration Guide.
Figure 55: Basic Settings > Alerting & Monitoring — health monitoring
|Name||SNMP alert ID||Description|
|Login failed||xcbLoginFailure||Failed login attempts from SPS web interface.|
|Successful login||xcbLogin||Successful login attempts into SPS web interface.|
|Logout from the management interface||xcbLogout||Logouts from SPS web interface.|
|Configuration changed||xcbConfigChange||Any modification of SPS's configuration.|
General alerts and error messages occurring on SPS.
Note that alerts on general alerts and errors are sent whenever there is an alert or error level message in the SPS system log. These messages are very verbose and mainly useful only for debugging purposes.
Enabling these alerts may result in multiple e-mails or SNMP traps sent about the same event.
|Data and configuration backup failed||xcbBackupFailed||Alerts if the backup procedure is unsuccessful.|
|Data archiving failed||xcbArchiveFailed||Alerts if the archiving procedure is unsuccessful.|
|Database error occurred||xcbDBError||An error occurred in the database where SPS stores the connection metadata. For assistance, contact our Support Team.|
|License limit reached||xcbLimitReached||The number of protected servers (or concurrent sessions) reached the limit set in the SPS license. Clients cannot connect to new servers using SPS.|
|HA node state changed||xcbHaNodeChanged||A node of the SPS cluster changed its state (for example, a takeover occurred).|
|Timestamping error occurred||xcbTimestampError||An error occurred during the timestaming process (for example, the timestamping server did not respond).|
|Time sync lost||xcbTimeSyncLost||The system time became out of sync.|
|Raid status changed||xcbRaidStatus||The status of the node's RAID device changed its state.|
|Hardware error occurred||xcbHWError||SPS detected a hardware error.|
|Firmware is tainted||xcbFirmwareTainted||A user has locally modified a file from the console.|
|Too many login attempts||xcbBruteforceAttempt||SPS has detected a possible brute-force attack.|
|License expires soon||xcbLicenseAlmostExpired||Your SPS license will expire within 60 days.|
|A system service failed||xcbInitSystemUnitFailed||
A system service has failed.
Note that one alert is sent for each failed service.