Configuring system monitoring for OneSpan Authentication Server Appliance Configuration Tool events

OneSpan Authentication Server Appliance Configuration Tool event targets monitor critical Configuration Tool events and can be configured in the OneSpan Authentication Server Appliance Configuration Tool. The source for these targets are audit messages that are generated by the System Configtool source. In the OneSpan Authentication Server Appliance Configuration Tool, select Monitoring > Audit Logs and check the Source column.

Targets for OneSpan Authentication Server Appliance Configuration Tool events

The following notification target types can be configured to monitor OneSpan Authentication Server Appliance Configuration Tool events:

• One or more SNMP traps
• One or more SMS
• One or more emails

Generally, when targets are defined as SNMP traps, a Management Information Base (MIB) file is also available and can be downloaded. MIB files contain the information about the notification and the variables of the MIB file (see  Downloading OneSpan MIB files).

SNMP traps about OneSpan Authentication Server Appliance Configuration Tool events will only be operational for audit lines that are generated by the OneSpan Authentication Server Appliance Configuration Tool itself.

Configuring system monitoring targets for OneSpan Authentication Server Appliance Configuration Tool events

To allow sending SMS, email, or SNMP trap notifications about OneSpan Authentication Server Appliance Configuration Tool events, the notification settings need to be configured.

To configure system monitoring targets for OneSpan Authentication Server Appliance Configuration Tool events

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Select Settings > Notifications.
3. Select Enabled to enable notification about OneSpan Authentication Server Appliance Configuration Tool events.

4. Add one or more notification target types for notification using Add target, and specify the settings for each notification target.

   

   Figure: Configuring notification settings

If SNMP traps are used as targets for OneSpan Authentication Server Appliance Configuration Tool events, the system event trap already contains all relevant event information data, which will be sent directly in the notification. Additional information may also be available in the audit messages. To view this information, open the OneSpan Authentication Server Appliance Configuration Tool, select Monitoring > Audit Logs and use the AMID number from the SNMP trap to look for additional information.

If you want to configure an SMS notification target, verify if you must use a country code or special characters when entering a mobile number. For more information, refer to the MDC or SMS provider documentation.

For more information about the different notification target settings, refer to the OneSpan Authentication Server Appliance Administrator Reference.

To receive notifications as SNMP traps you need to configure an SNMP trap server (see  Configuring SNMP trap handlers).

Filtering OneSpan Authentication Server Appliance Configuration Tool events for notification

You can filter OneSpan Authentication Server Appliance Configuration Tool events that you want to be notified about. By defining one or more filters you describe which audit messages need to be filtered. The definition of an audit filter is similar to the definition of an audit filter as part of a report definition.

To add a system monitoring filter for OneSpan Authentication Server Appliance Configuration Tool events

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Select Settings > Notifications.

3. Click Add New in the Targets field. Then, select the required type and fill in the appropriate details.

   This new notification target will now be available for all filters of the same source, but not for other sources or events. For example, targets added via Settings > Notifications will not be available under Authentication Server > System Monitoring Alerts.

4. Click Add filter to add a new notification filter.

5. Configure the filter in the Notification Filter dialog:

   1. Select Enabled.
   2. Specify a name for the notification filter.
   3. Select the notification target to which the filter will be applied.

   4. Click Add Filter and fill in the required filter parameters.

      Repeat this step until you have added all required filtering rules.

   5. Click Add.
6. Select Enabled to activate the alert system.

When assigning multiple filters to a notification target, the notification target will only be triggered when the match criteria of all assigned filters are met.

OneSpan Authentication Server Appliance allows you to use a complex system of multiple filters and targets to be notified via different targets in case specific audit messages are generated.

Useful filters are:

• System actions

  Code equals S-024002. This filters for changes regarding login, logout, reboot, shutdown, system update, administrator password change, license change, support change etc.

• Configuration change

  Code equals S-024001. This filters all changes to OneSpan Authentication Server Appliance Configuration Tool settings.

For more information about system monitoring filters and targets, refer to the OneSpan Authentication Server Appliance Administrator Reference.