How to determine which A2A Clients are registered to which PAM instances?

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Privileged Access Management (PAM) Admin has thousands of PAM A2A Clients registered into PAM.  They want to make sure their Load Balancer is balancing their A2A registrations to every PAM cluster member.  In the UI, they can go into each individual A2A Client, to determine who is the owning PAM Instance.  However they want to generate a report on all of this and the counts.

Resolution

This raw information can be produced from the following pamcli command:

capam_command capam=capamServer adminUserID=admin cmdName=searchRequestServer requestServer.clientVersion = 4.12.3

that will dump all 4.12.3 A2A Clients with their associated machine_id (PAM Instance) values that they are registered to.

Then with the following API call -> GET /cspm/ext/rest/configProperties, you can use obtain the hardwareid for all PAM Cluster Instances.

This hardwareid equals the machine_id from the pamcli command above.

With this information you can then count the request servers (A2A clients) registered to a particular PAM cluster instance.