Reset Search
 

 

Article

How can I get an email notification of a failed login attempt to the Extreme Wireless GUi?

« Go Back

Information

 
TitleHow can I get an email notification of a failed login attempt to the Extreme Wireless GUi?
Objective

How can I get an email notification of a failed login attempt to the Extreme Wireless Controller GUi? 
How can I get an email notification of a failed login attempt to the ExtremeCloud Appliance  GUi? 
Can I see failed login attempts? 

Environment
  • ExtremeWireless Controller
  • ExtremeCloud Appliance
  • ExtremeManagement
  • XCC
  • XMC
  • EWC
  • XCA
  • Failed login
  • Authentication audit
  • All Versions
Procedure
  1. The Extreme Wireless Controller or Cloud Appliance must have Radius Authentication enabled. How to use RADIUS for controller management login
  2. In the Controller --> Logs --> Logs Configuration, configure: Controller Log Level -->  "Information". Syslog should be configured to send Audit messages and Service messages to XMC. 
  3. With Radius enabled for Login Management enabled, there will be Information log messages in the Event Log and also Login Audit log.
  4. Messages will be similar to this syntax:
Success:  events: PAM Log Filter May 13 10:42:04 EWC1 gui_s_mgr: pam_unix(www:session): session opened for user admin by (uid=0) 3
Failure:   events: PAM Log Filter May 13 10:41:56 EWC1 pam_radauth[1598]: (www) User [extreme1] has been rejected in authentication on radius server
  1. Create a custom Alarm in XMC with keywords of  “PAM Log Filter” and “has been rejected in authentication”
User-added image
  1. After saving that, go to “Action” tab à Add à Email Action.  From there you need to add in an email list, or specific email addresses you want the Alarm mailed too.
User-added image

Save this and the new Alarm will trigger an Email notification when seen. 
Additional notes

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255