Alert Details

Certificate Manager Component (Monitor & Auth Service) has system default settings that are NOT user configurable.

• Polling frequency for certificate expiry notice: daily
• Monitors the following EFA Certificate Types:

  Sr No	Type	Value
  1	App Server certificate (of EFA)	app_server_cert
  2	Default Intermediate CA	default_intermediate_ca
  3	Default Root CA	default_root_ca
  4	Third-Party CA	third_party_ca
  5	K3s Server Certificate	k3s_server_cert
  6	K3s CA	k3s_ca
  7	JWT Certificate	jwt_cert

The daily polling sends the “CertificateExpiryNoticeAlert” event notification with an expiry date per certificate type which is processed by the fault engine.

Syslog RFC-5424 Example:

<116>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/System/Security/Certificate?type=app_server_cert” 
   alertId=”31000”  	  
   cause=”keyExpired”  
   type=”securityServiceOrMechanismViolation”  
   severity=”warning”]   
   [alertData@1916  
   certifcateType=”App Server certificate”  
   expiryDate=”Sep 12 10:00:45 2022 GMT”] 
   BOM The application server certificate on EFA will expire soon

{
    Resource: /App/System/Security/Certificate?type=app_server_cert
    HQI {
        Color: Yellow
        Value: 1
    }
    StatusText: Application Server Certificate expires on <date>.
}

K3s must be up and running (k3s goes down if k3s certs have expired)

Only supports non-k3s cert expiry.

• Polling frequency for certificate expiry notice: daily
• Monitors the following EFA Certificate Types:

  Sr No	Type	Value
  1	App Server certificate (of EFA)	app_server_cert
  2	Default Intermediate CA	default_intermediate_ca
  3	Default Root CA	default_root_ca
  4	Third-Party CA	third_party_ca

If the App server certificate gets expired, you cannot communicate with EFA via REST API. Therefore, you cannot query the health status.

Syslog RFC-5424 Example:

<114>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/System/Certificate?type=app_server_cert” 
   alertId=”31002”  	  
   cause=”keyExpired”  
   type=”securityServiceOrMechanismViolation”  
   severity=”critical”]   
   [alertData@1916  
   certificateType=”App Server certificate”  
   expiredDate=”Sep 12 10:00:45 2022 GMT”] 
   BOMThe Application server certificate on EFA has expired “Sep 12 10:00:45 2022 GMT”.

SLX device‘s syslog server configuration is set to EFA IP so that the RASLog service receives events from the SLX device. Syslogs from the SLX device may not be sent to the RASLog Service if syslog CA cert has expired.

• Polling frequency for certificate expiry notice: daily
• Monitors the following Device Certificate Types:

  Sr No	Type	Value
  1	HTTPS Server certificate	https_server_cert
  2	Syslog CA	syslog_ca
  3	JWT Verifier (OAuth2)	jwt_verifier

The daily polling sends the “DeviceCertificateExpiredNoticeAlert” event notification with an expiry date per certificate type which is processed by the fault engine.

Syslog RFC-5424 Example:

<114>1 2022-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/System/Security/Certificate?device_ip=10.10.10.1&type=https_server_cert” 
   alertId=”31003”  
   cause=”keyExpired”  
   type=”securityServiceOrMechanismViolation”  
   severity=”critical”]   
   [alertData@1916  
   deviceIP=”10.10.10.1”    
   certifcateType=”HTTPS Server certificate”  
   expiryDate=”Sep 12 10:00:45 2022 GMT”] 
  BOMThe certificate on device “10.10.10.1” with subject “CN=slx- 10.10.10.1.extremenetworks.com” has expired at “Sep 12 10:00:45 2022 GMT”

Response

{
    Resource:/App/System/Security/Certificate?device_ip=10.10.10.1&type=https_server_cert
    HQI {
        Color: Red
        Value: 3
    }
    StatusText: Https server certificate x=on device 10.10.10.1 expired on <date>.
}

• For all the certificates managed by EFA, send an alert on renewal of any of the certificates.
• The following table describes the types of certificates that EFA raises alerts for renewal:

  Sr No	Type	Value
  1	App Server certificate (of EFA)	app_server_cert
  2	Default Intermediate CA	default_intermediate_ca
  3	Default Root CA	default_root_ca
  4	Third-Party CA	third_party_ca
  5	JWT Certificate	jwt_cert
  	K3s Server Certificate	k3s_server_cert
  	K3s CA Certificate	k3s_ca

Syslog RFC-5424 Example:

Syslog RFC-5424 Example:
<116>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental  
   [meta sequenceId=”47”]
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]
   [alert@1916
   resource=”/App/System/Security/Certificate?type=app_server_cert”
   alertId=”31004”           
   cause=”keyGenerated”
   type=”securityServiceOrMechanismViolation”
   severity=”warning”] 
   [alertData@1916
   certifcateType=”App Server certificate”]
  BOMThe application server certificate on EFA has been renewed

Syslog RFC-5424 Example:

<118>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental  
   [meta sequenceId=”47”]
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]
   [alert@1916
   resource=”/App/System/Security/Certificate?device_ip=10.10.10.1&type=https_server_cert”
   alertId=”31005”           
   cause=”keyGenerated”
   type=”securityServiceOrMechanismViolation”
   severity=”info”] 
   [alertData@1916
   deviceIP=”10.10.10.1”    
   certifcateType=”HTTPS certificate”]
  BOMThe device 10.10.10. 1HTTPS server certificate has been renewed.

Alert Data:

• Username

Syslog RFC-5424 Example:

<118>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/System/Security/Authentication” 
   alertId=”31011”  	  
   cause=  
   type=  
   severity=”info”]   
   [alertData@1916  
   userName=”bob”] 
  BOM Successful login. 

The polling is enabled only if:

1. LDAP servers are configured in the system.
2. Authentication fallback preference is set to LDAP.

• All the LDAP servers that are added in the fallback sequence will be monitored.
• Polling frequency: hourly
• During the poll, login is performed with the base user that is configured in the system.

1. LDAP Server IP
2. Reason

Syslog RFC-5424 Example:

<115>1 2003-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/System/Security/Authentication” 
   alertId=”31030”  	  
   cause=”underlyingResourceUnavailable”  
   type=”communicationsAlarm”  
   severity=”major”]   
   [alertData@1916  
   ldapServerIP=”10.x.x.x”  
   reason=”Unable to reach the LDAP server”] 
   BOMThe connection to LDAP Server could not be established.

System Component (Monitor Service) has system default settings that are NOT user configurable.

• Polling frequency for storage utilization threshold notice: hourly
• Storage Utilization Thresholds:
  • Under 75% - info (31042 is raised)
  • 75% - warning
  • 85% - minor
  • 95% - major
  • 97% - critical
• Monitors the TPVM storage utilization on the following mount points:
  • “/” (/dev/vda2)
  • “/apps” (/dev/vdb1)

The hourly polling sends an “Alert” event notification with the TPVM storage utilization percentage which is processed by the fault engine.

System Component (Monitor and System Service) has system default settings that are NOT user configurable.

• Polling frequency for storage utilization threshold notice: hourly
• Monitors the TPVM storage utilization on the following mount points:
  • “/” (/dev/vda2)
  • “/apps” (/dev/vdb1)

The hourly polling sends an “Alert” event notification with the TPVM storage utilization percentage which is processed by the fault engine.

System Component (Monitor Service) has system default settings that are NOT user configurable.

• Polling frequency for storage utilization threshold notice: hourly

The “Under 75%” info level storage threshold alert is sent once on Monitor Service startup and once to clear the unhealthy storage resource path.

All other severities, higher than info level, are continually sent at the polling frequency.

EFA 3.1.0 has a timer task to periodically monitor the status of the standby node. The timer task checks the status of the nodes and raise an event to the fault management system, which in-turn will raise an Alert to indicate to the user that the system isn‘t fully redundant.

• Polling frequency for HA events: every minute

A timer task will periodically check the status of the nodes and raise an event to the fault management system, which in turn will raise an Alert to indicate to the user that the system is fully redundant.

• Polling frequency for HA events: every minute

A timer task will periodically check the status of the nodes and raise an event to the fault management system, which in turn will raise an Alert to indicate to the user that an HA failover has occurred.

• Polling frequency for HA events: every minute

The polling is enabled only if

• Configure or Enable Health Check to determine when EFA loses contact with SLX.

Example (User Configuration):

• efa inventory device setting update --ip=10.10.10.1 --health-check-enable Yes --health-check-interval 6m --health-check-heartbeat-miss-threshold 5

The polling sends the “DeviceConnectivityFailureAlert” event notification upon loss of contact.

Alert Data:

1. Device IP
2. FailedAdapters
3. FailureReason

Syslog RFC-5424 Example:

<114>1 2022-10-11T22:14:15.003Z efa.machine.com EFAFaultManager - Environmental    
   [meta sequenceId=”47”]  
   [origin ip=”10.20.30.40” enterpriseId=”1916” software=”EFA” swVersion=”3.1.0”]  
   [alert@1916  
   resource=”/App/Component/Asset/Device?device_ip=10.10.10.1” 
   alertId=”31501”  
   cause=”connectionEstablishmentError”  
   type=”communicationsAlarm”
   severity=”major”]   
   [alertData@1916  
   deviceIP=”10.10.10.1”  
   failedAdapters=”ssh rest netconf” 
   failureReason=”Authentication failed” 
   BOMContact has been lost with device “10.10.10.1”

The polling will be enabled only if

• Configure/Enable Health check to watch for device connectivity.

Example (User Config):

• efa inventory device setting update --ip=10.10.10.1 --health-check-enable Yes --health-check-interval 6m --health-check-heartbeat-miss-threshold 5

The polling sends the “DeviceConnectivitySuccessAlert” event notification upon loss of contact.