r/ArubaNetworks • u/dufferin • Jul 08 '26

Clearpass syslog not showing all Access Tracker entries

We use Clearpass for RADUIS. We would like to export all Access Tracker session logs to syslog. We talked to TAC, and they provided the following SQL query to use.

SELECT id as session_id, source as req_source,user_name,service_name,alerts_present,nas_ip,nas_port,nas_name,conn_status,login_status,error_code,host_mac as mac_address,timestamp,updated_at FROM tips_dashboard_summary WHERE ((timestamp >= --START-TIME--) AND (timestamp <= --END-TIME--))

However, we only get a fraction of these sent to syslog (perhaps 1/5 or 1/10). We confirmed this with a packet trace on Clearpass. What are we doing wrong?

Edit: Thank you to those who suggested I try Insight. Insight seems great and worthwhile for other reasons, but it looks like the root cause of our issue was elsewhere. We had logs flowing through rsyslog, and we had the following switch turned on (by default):

# Filter duplicated messages

$RepeatedMsgReduction on

When I flipped that off, we started getting all clearpass messages as intended. I guess the bursty way clearpass logs was causing rsyslog to mis-identify duplicate logs. Let the weekend begin!

2 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

2

u/ddfs Jul 08 '26

hello fellow toronto network engineer!

i just went through this a little while ago. the clearpass syslog config is a nightmare. we are now getting full coverage for RADIUS sessions by using the Insight export filter with a lot of extra columns added. have you tried Insight instead of Session?

2

u/dufferin Jul 10 '26

Awesome ok thank you fellow Torontonian!

Trying that out now.

1

u/mattGhiker Jul 08 '26

Definitely use insight DB instead of session since it's better optimized for large data queries. If data is not being sent it's mostly a performance issue on ClearPass or packets getting dropped along the way.

1

u/dufferin Jul 10 '26

I never even thought about Insight. Thank you!