How to capture the event logs generated by Cisco Clean Access Manager

[TCC_2]

Resolution

Complete these steps in order to capture the event logs and send those to another server for archiving and investigation:

1. Log on to the Cisco Clean Access Manager (CAM) as root.
   
   
2. Issue the psql -h 127.0.0.1 controlsmartdb -U postgres command.
   
   
3. Issue the \a command.
   
   
4. Issue the \o  /root/LogInformationTable command.
   
   
5. Choose * from log_info. Make sure you put the semi-colon ; in, otherwise it does not work.
   
   
6. Issue the \q command.
   
   
7. Track the LogInformationTable file in your root directory, which holds all your records from the log_info table from the database. This file is in text format too, delimited by the | character. 
   
   
8. Enable syslog and capture the events on the syslog.

Refer to Clean Access Manager Installation and Administration Guide for more information.

Refer How to configure Clean Access Manager (CAM) to report events to Cisco Secure Monitoring Analysis and Response System (CS-MARS) for more information on how to configure Clean Access Manager in order to report events to Cisco Security Monitoring, Analysis and Response System (CS-MARS).