Security

I have just been trying to poll the license usage via SNMP from our CPPM appliances and it took me a while to work out why it is failing.  The OIDs for license usage are Traps, which makes no sense to me as they are not events which can generate a trap.  License over-utilisation is a trap - an event occurs which fires a trap, but the current active licenses and licenses in use are not events.  So if you can't poll them (which you can't because they are traps) then what would cause these to be sent?  There's no hint in the MIB, this is the description:

A trap which indicates the ClearPass cluster license utilization details of the application.
<cppmNodeApplicationName> indicates the name of the application,
<cppmClusterLicenseTotalCount> indicates total cluster-wide
license count of the application,
<cppmClusterLicenseUsageCount> indicates the used
cluster-wide license count of the application.

It's not just licenses either - there are loads like this, such as cppmDiskSpaceRemaining (there is another trap "LowDiskSpace" which makes perfect sense), cppmImageFile, cppmServiceName, there are loads of these which are values, not events.

How can these be used?

-------------------------------------------

Your reading of the MIB is right, and it's not just you: those license objects are varbinds that ride on the utilization trap, not gauges you can poll. ClearPass emits that trap on its own license-utilization events rather than in response to a GET, which is why your poller gets nothing. Internally the license usage counter refreshes on a roughly fifteen minute cycle, the same number the Event Viewer shows, so even the trap's view isn't real time.

For actual polling, skip SNMP and hit the REST API instead. The cppm-license endpoint returns total and used counts per application cluster-wide, it answers on demand, and it's what tools like the PowerArubaCP module use under the hood. An API client with a read-only operator profile plus a scheduled GET gives you the graph you were trying to build, on whatever interval you want.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

I use a mix of API and SNMP. I agree with Dustin, this value does not exist in snmp for licensing info. 

What monitoring system do you use, I just wrote a java/groovy module for logicmonitor over the last few days for pulling license info.  I do like the the Authentication Sources data via SNMP as you can break down all sources for auth/autz and understand where the latency is. This could just be overhead latency to Endpoints or maybe something a bit more complex like  Intune via API. It was always nice to see LDAP and RPC latency on the AD servers as well.  We had issues with our old setup and the RPC calls would be delayed when our hyper-v hosts would get patched sometimes. 

The protocol stats have always been useful, I am not a fan on how they keep rolling data for the last 24 hours. It makes a bit more difficult to plot radius timeouts, failed, and success in a nice graph. I have had a few takes on this approach in multiple monitoring systems.