Emergency Events to be Monitored and Data Sources

OneSpan Authentication Server Appliance can monitor different types of events. We recommend to monitor the following events:

• System OS events (produce OS traps)
• OneSpan Authentication Server Appliance Configuration Tool events (produce notifications)
• OneSpan Authentication Server events (produce system monitoring alerts)

For more information about system monitoring via SNMP, refer to the OneSpan Authentication Server Appliance Administrator Guide.

System OS events

Emergency alerts are sent for critical system OS events such as:

• Disk space status. For instance, a full disk would prevent that additional audit logs are being written.
• Memory status. A warning is produced if the system memory is filling.
• SNMP status.
• Certain processes that are started or stopped.

The following emergency alerts sent by OneSpan Authentication Server Appliance need to be attended in any case to ensure system functionality:

• The OneSpan Authentication Server Appliance hard disk drive is more than 90 percent full.
• A critical service is not running, e.g. the OneSpan Authentication Server daemon, syslog, or database daemon.
• The swap memory is full.

System OS events – Data source

For critical system OS events, OneSpan Authentication Server Appliance monitors audit messages that are generated when such critical system OS events occur. Emergency alerts of this type can only be sent via SNMP traps and cannot be customized. They can only be enabled or disabled for each SNMP version. Different types of SNMP alerts are available for the different SNMP versions. If enabled, all emergency alerts are sent to the SNMP server.

OneSpan Authentication Server Appliance Configuration Tool events – Data source

OneSpan Authentication Server Appliance monitors audit messages generated by the System Configtool source for all Configuration Tool events.

OneSpan Authentication Server events – Data source

OneSpan Authentication Server Appliance monitors OneSpan Authentication Server components via the audit messages generated by the Identikey Server source and sends notifications via SMS, email, or SNMP traps. You can configure which audit messages are monitored via the source field of an audit message.