Certificate Alerts

• Polling frequency for certificate expiry notice is daily.
• Monitors the following types of XCO certificate and its value:
  • App Server Certificate (of XCO): app_server_certificate
  • Default Intermediate CA: default_intermediate_ca
  • Default Root CA: default_root_ca
  • Third-Party CA: third_party_ca
  • K3s Server Certificate: k3s_server_certificate
  • K3s CA: k3s_ca
  • JWT Certificate: jwt_certificate

The polling service sends the “CertificateExpiryNoticeAlert” notification with an expiry date.

The following example shows an alert when an XCO certificate (for example, App Server Certificate) is about to expire:

<116>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - -
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]  
   [alert@1916
   resource=”/App/System/Security/Certificate?type=app_server_certificate”
   alertId=”31000”
   cause=”keyExpired”
   type=”securityServiceOrMechanismViolation” 
   severity=”warning”] 
   [alertData@1916  
   type=”app_server_certificate”  
   expiry_date=”Sep 12 10:00:45 2022 GMT”] 
   BOMThe App Server Certificate on the application will expire soon on “Sep 12 10:00:45 2022 GMT”. 

{
    Resource: /App/System/Security/Certificate?type=app_server_certificate
    HQI {
        Color: Yellow
        Value: 2
    }
    StatusText: The App Server Certificate on the application will expire soon on “Sep 12 10:00:45 2022 GMT”. 
}

Only supports non-k3s cert expiry.

• Polling frequency for certificate expiry notice is daily
• Monitors the following types of XCO Certificate and its value:
  • App Server Certificate (of XCO): app_server_certificate
  • Default Intermediate CA: default_intermediate_ca
  • Default Root CA: default_root_ca
  • Third-Party CA: third_party_ca

When the App Server Certificate expires, you cannot communicate with XCO via REST API. Therefore, you cannot query the health status.

The following example shows an alert when an XCO certificate (for example, App Server Certificate) is expired:

<113>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - -    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]  
   [alert@1916  
   resource=”/App/System/Security/Certificate?type=app_server_certificate” 
   alertId=”31002”  	  
   cause=”keyExpired”  
   type=”securityServiceOrMechanismViolation”  
   severity=”critical”]   
   [alertData@1916  
   type=”app_server_certificate”  
   expire_date=”Sep 12 10:00:45 2022 GMT”] 
   BOMThe App Server Certificate on the application has expired on “Sep 12 10:00:45 2022 GMT”.

• Polling frequency for certificate expiry notice is daily.
• Monitors the following types of Device Certificate and its value:
  • Syslog CA: syslog_ca
  • JWT Verifier (OAuth2): jwt_verifier

The polling service sends the “DeviceCertificateExpiredNoticeAlert” notification with an expiry date.

The following example shows an alert when an SLX certificate (for example, Syslog CA) is expired:

<113>1 2022-10-11T22:14:15.003Z xco.machine.com FaultManager - -    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]  
   [alert@1916  
   resource=”/App/System/Security/Certificate?device_ip=10.10.10.1&type=syslog_ca” 
   alertId=”31003”  
   cause=”keyExpired”  
   type=”securityServiceOrMechanismViolation”  
   severity=”critical”]   
   [alertData@1916  
   device_ip=”10.10.10.1”    
   type=”syslog_ca”  
   expiry_date=”Sep 12 10:00:45 2022 GMT”] 
  BOMThe Syslog CA on device “10.10.10.1” has expired on “Sep 12 10:00:45 2022 GMT”

Response

{
    Resource:/App/System/Security/Certificate?device_ip=10.10.10.1&type=syslog_ca
    HQI {
        Color: Black
        Value: 5
    }
    StatusText: The Syslog CA on device “10.10.10.1” has expired on “Sep 12 10:00:45 2022 GMT.
}

• Sends an alert for renewal of the certificates managed by XCO.
• XCO sends a renewal alerts for the following types of certificate and its value:
  • App Server Certificate (of XCO): app_server_certificate
  • Default Intermediate CA: default_intermediate_ca
  • Default Root CA: default_root_ca
  • Third-Party CA: third_party_ca
  • JWT Certificate: jwt_certificate
  • K3s Server Certificate: k3s_server_certificate
  • K3s CA Certificate: k3s_ca

The following example shows an alert when an XCO certificate is renewed:

Syslog RFC-5424 Example:
<118>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - -  
   [meta sequenceId=”47”]
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]
   [alert@1916
   resource=”/App/System/Security/Certificate?type=app_server_certificate”
   alertId=”31004”           
   cause=”keyGenerated”
   type=”securityServiceOrMechanismViolation”
   severity=”warning”] 
   [alertData@1916
   type=”app_server_certificate”]
  BOMThe App Server Certificate on the application has bee renewed.

The following example shows an alert when a device certificate is renewed:

<118>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - -  
   [meta sequenceId=”47”]
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]
   [alert@1916
   resource=”/App/System/Security/Certificate?device_ip=10.10.10.1&type=https_server_certification”
   alertId=”31005”           
   cause=”keyGenerated”
   type=”securityServiceOrMechanismViolation”
   severity=”info”] 
   [alertData@1916
   device_iP=”10.10.10.1”    
   type=”https_server_certification”]
  BOMThe HTTPS Server Certificate on the device 10.10.10.1 has been renewed.

• Polling frequency for certificate expiry notice: daily
• Monitors the following XCO Certificate Types:
  • App Server Certificate (of XCO): app_server_certificate
  • Default Intermediate CA: default_intermediate_ca
  • Default Root CA: default_root_ca
  • Third-Party CA: third_party_ca
  • K3s Server Certificate: k3s_server_certificate
  • K3s CA: k3s_ca
  • JWT Certificate: jwt_certificate
  • GlusterFS certficate: glusterfs_certficate
  • Galera Certificate: galera_certificate

The "DeviceCertificateUnreadableAlert" event notification is sent out daily with error message when XCO is unable to read a certificate of a particular type. The fault engine will process this event.

The following example shows an alert when XCO is unable to read a certificate:

Syslog RFC-5424 Example:
<116>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - - 
   [meta sequenceId=”47”]   
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.5.0”]   
   [alert@1916 
   resource=”/App/System/Security/Certificate?type=app_server_certificate” 
   alertId=”31006” 
   cause=”keyExpired” 
   type=”securityServiceOrMechanismViolation”  
   severity=”warning”]  
   [alertData@1916   
   type=”app_server_certificate”   
   error=”Unable to read the expiration date of certificate”]  
   BOMUnable to read app_server_certificate on the application due to Unable to read the expiration date of certificate.

• Polling frequency for certificate expiry notice: daily
• Monitors the following XCO Certificate Types:
  • HTTPS Server certificate: https_server_certficate
  • JWT Verifier: jwt_verifier
  • Syslog CA: syslog_ca

The "DeviceCertificateUnreadableAlert" event notification is sent out daily with error message when XCO is unable to read a certificate of a particular type on a particular device. The fault engine will process this event.

The following example shows an alert when when XCO is unable to read the device certificate:

Syslog RFC-5424 Example:
<116>1 2003-10-11T22:14:15.003Z xco.machine.com FaultManager - - 
   [meta sequenceId=”47”]   
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.5.0”]   
   [alert@1916 
   resource=”/App/System/Security/Certificate?type=https_server_certificate&device_ip=10.20.30.40” 
   alertId=”31007” 
   cause=”keyExpired” 
   type=”securityServiceOrMechanismViolation”  
   severity=”warning”]  
   [alertData@1916   
   type=”app_server_certificate” 
   device_ip=”10.20.30.40”  
   error=”Unable to read the certificate”]  
   BOMUnable to read https_server_certificate on the device 10.20.40.40 due to Certificate is not available.

The SLX device is registered in inventory service.

• You can run a command for device removal from inventory service.
• Monitors the following types of Device Certificates:
  • HTTPS Server Certificate: https_server_certification
  • Syslog CA: syslog_ca
  • JWT Verifier (OAuth2): jwt_verifier

The removed device sends three alerts to clear any unhealthy state in the health service.

The following example shows an alert when an SLX device is removed:

<118>1 2022-10-11T22:14:15.003Z xco.machine.com FaultManager - -   
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”XCO” swVersion=”3.4.0”]  
   [alert@1916  
   resource=”/App/System/Security/Certificate?device_ip=10.10.10.1&type=https_server_certification” 
   alertId=”31008”  
   cause=”configRemoved”  
   type=”securityServiceOrMechanismViolation”  
   severity=”info”]   
   [alertData@1916  
   device_ip=”10.10.10.1”    
   type=”https_server_certification”] 
  BOMThe device 10.10.10.1 has been removed so cleaning up HTTPS Server Certificate