Can I enable SNMP traps to monitor the status of CA UARM Virtual Appliance?

Products

• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

Issue: 

Is it possible to enable SNMP traps on the UAR server to be able to monitor its status?

 

Environment:  

All supported versions of User Activity Reporting (UAR)

 

Workaround:

As the UAR server uses a modified version of Linux (CentOS) for its OS (technically it is an appliance) it does not have the capability to directly send SNMP traps.

The possible 'workaround' for UAR to be able to send SNMP traps regarding the Linux (CentOS) OS events would be to configure the UAR 'Linux_localsyslog_Connector' to collect syslog events from the UAR Server OS. Once the syslog events are collected UAR could then be configured to have the 'Alert Management' process configured to use a query that would send an SNMP trap whenever an event was collected by the 'Linux_localsyslog_Connector'.

(One cautionary note: the bulk of the events collected by the 'Linux_localsyslog_Connector' are of the 'informational' type. (Process start, stop, status, etc.) Sending all syslog events generated by the UAR server may be problematic in relation to network load.)

 

If you would decide to use the workaround the instructions to implement SNMP Traps with UAR are located in the UAR Administration Guide in 'Chapter 11: Action Alerts' > 'Working with SNMP Traps' section.

Environment

Release: ETRDIR10600-12.6-Directory
Component: