- The Extreme Wireless Controller or Cloud Appliance must have Radius Authentication enabled. How to use RADIUS for controller management login
- In the Controller --> Logs --> Logs Configuration, configure: Controller Log Level --> "Information". Syslog should be configured to send Audit messages and Service messages to XMC.
- With Radius enabled for Login Management enabled, there will be Information log messages in the Event Log and also Login Audit log.
- Messages will be similar to this syntax:
Success: events: PAM Log Filter May 13 10:42:04 EWC1 gui_s_mgr: pam_unix(www:session): session opened for user admin by (uid=0) 3
Failure: events: PAM Log Filter May 13 10:41:56 EWC1 pam_radauth: (www) User [extreme1] has been rejected in authentication on radius server
- Create a custom Alarm in XMC with keywords of “PAM Log Filter” and “has been rejected in authentication”
- After saving that, go to “Action” tab à Add à Email Action. From there you need to add in an email list, or specific email addresses you want the Alarm mailed too.
Save this and the new Alarm will trigger an Email notification when seen.