Symantec Access Management

Hi people, I have implemented the graylog solution with the objective to monitoring siteminder smps and smacces logs, extract the data and work with it.

One of my biggest problems in my environment is the number of policy servers, actually I have 4 in production environment and another 4 in homolog environment, so when some problems happens is 8 servers to search through logs to find any issue.

With this implementation, I reduce my team time analysis and set triggers to prevent some situations.

Software used:

Graylog (web and server): Create dashboard, manipulate and collect the data

ElasticSearch: Store the manipulated data

MongoDB: Store dashboard info and graylog-server info.

Rsyslog: Send data to graylog

Bellow you can see the dashboard showing all info listed here:

Siteminder Current connection by policy server

Siteminder Current Depth by policy server

AzAccept Count

AuthAccept Count

Top consuming resource agents.

Siteminder Error

Exceeded limit count

After configuring the solution I created a graylog Contentpack for siteminder, you can find the content pack in this link: ppoffal/siteminder-Graylog-ContentPack: A G... - GitHub

Hi Paulo,

This is brilliant. Thank you for sharing this with the community.

Have you also looked into the built in OneView Monitor ?

OneView Monitor - CA Single Sign-On - 12.52 SP1 - CA Technologies Documentation

Cheers,

Ujwol Shrestha

thanks paulo. do you have any draft documentation that you happen to make up when you install and integrated the graylog components.

that will be helpful to what im doing and will add more details to that document.

You can use the graylog documentation.

Welcome to the Graylog documentation — Graylog 1.3.0 documentation

And 2 more how to

https://www.digitalocean.com/community/tutorials/how-to-install-graylog2-and-centralize-logs-on-ubuntu-14-04

How to install Graylog2 on CentOS 7 / RHEL 7

Hi Paulo,

Can this setup be used with logstash instead of rsyslog ?

Regards,

Akshay.

Hi, yes you can, but you will need to adjust the configuration in logstash to send the log in an expected format or change the extractor regex.