Security

Anyone please advises how to analyzer the clearpass logs?  what tool can read the clearpass logs etc?  or where can i look in the logs just download from the CPPM to see who change stuff in clearpass it cause the clearpass going down.  any assist will appreciate.  Thank you

Event Viewer or Audit Logs.  You can also send the ClearPass logs to any syslog receiver or SIEM.

the system logs i export out from Clearpass,  want to see who change and who doing what in the appliance.

If you want to export those logs to your SIEM via syslog you need to have a Syslog Export Filter (Administration - External Servers - Syslog Export Filters) set using the Export Template "Audit Records". Here is an output from that;

Jun 27 15:03:12 2023-06-27 15: 03:12,373 X.X.X.X CPPM_Audit_Record 956 1 0 Timestamp=Jun 27 2023 15:03:01.965 EDT,EntityName=<Service Name> Wireless,Category=Radius Enforcement Service,Action=MODIFY,User=waltr