cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1414
Views
0
Helpful
0
Replies

Event Detector Identity - match aaa-attribute

radek_rams
Level 1
Level 1

Hi,

 

I want to catch event when endpoint receive specific aaa-attribute (vlan assignment). 

I've tried syntax below but without success:

event identity interface regexp .* authz-complete aaa-attribute Tunnel-Private-Group 

What is a valid name for aaa-attribute?

 

Second question: identity detector has variable  $_identity_<attribute> 

How to access this variable? If Tunnel-Private-Group would be correct then variable has name $_identity_Tunnel-Private-Group?

I did "debug event manager all" but culdn't found such data, only this:

 

000287: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_event_type value:291
000288: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_event_type_string value:identity
000289: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_event_severity value:severity-normal
000290: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_identity_stage value:authz-complete
000291: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_identity_status value:success
000292: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_identity_interface value:GigabitEthernet1/0/18
000293: May 13 10:34:18.430: EEM: policy_dir xml builtin: name:_identity_mac value:xxxx.xxxx.xxxx

 

0 Replies 0
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: