Smarter by Design.Simpler for Business
ags notifications
The ags notifications command manages the notification profiles that determine what will produce an alarm on an access gateway and where the alarm will go. Its panel equivalent is the Notification Profiles screen.
The profile is bound to the gateway with the --notificationProfile field; as long as it is not bound, its own settings do not work.
Command Summary
admin@TR7LBWAF01> ags notifications list # list all of them
admin@TR7LBWAF01> ags notifications show <id> # show one
admin@TR7LBWAF01> ags notifications add name <name> … # new profile
admin@TR7LBWAF01> ags notifications update id <id> … # change
admin@TR7LBWAF01> ags notifications delete <id> # delete
admin@TR7LBWAF01>
Required Fields
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | name | Required | The name of the profile |
There is no other required field; the thresholds and the channels are optional.
The Alarm Thresholds
When a threshold field is left empty, that alarm is not produced. When they are given, the smallest value is 1.
| Field | Default | The alarm condition |
|---|---|---|
--notifyEngineStatus | true | When the access engine of the gateway does not work or is unhealthy |
--notifyAuthFailRate | — | When the number of failed logins in the last minute exceeds this value |
--notifyMfaFailRate | — | When the number of wrong MFA answers in the last minute exceeds this value |
--notifyActiveLockouts | — | When the number of accounts locked at that moment reaches this value |
--notifyAuthSessions | — | When the number of verified sessions reaches this value |
The engine alarm is on by default
The gateways to which a notification profile is not bound also produce an alarm for the engine state. --notifyEngineStatus false is used only in order to give up this alarm.
The Notification Channels
| Field | Default | Value |
|---|---|---|
--notifyUi | true | A notification is shown in the panel |
--notifySnmp | false | An SNMP notification is sent |
--notifyEmail.0 | Empty | The e-mail addresses to which the alarm will go; every address with its own index |
--notifySms.0 | Empty | The telephone numbers to which the alarm will go; every number with its own index |
The Sign-in E-mail
| Field | Default | Value |
|---|---|---|
--notifyUserLogin | false | At every successful login it sends a "there is a new sign-in to your account" e-mail to the own address of the user |
--userLoginSubject | — | Only while this option is on; the subject of the e-mail. If it is left empty, the ready subject translated into the language of the user is used |
The e-mail is sent with the e-mail settings of the system; the users whose address is not known are skipped silently.
Examples
admin@TR7LBWAF01> ags notifications add name access-alarms \
--notifyAuthFailRate 50 --notifyMfaFailRate 20 --notifyActiveLockouts 10 \
--notifyEmail.0 security@institution.local --notifyEmail.1 noc@institution.local
admin@TR7LBWAF01>
admin@TR7LBWAF01> ags notifications update id <kimlik> \
--notifyUserLogin true --userLoginSubject "There is a new sign-in to your account"
admin@TR7LBWAF01>
admin@TR7LBWAF01> ags gateway update id <vService> --notificationProfile <profile>
admin@TR7LBWAF01>
Updating and Deleting
admin@TR7LBWAF01> ags notifications update id <kimlik> --notifyAuthFailRate 100
admin@TR7LBWAF01> ags notifications update id <id> --notifyEmail.delete # empty the addresses
admin@TR7LBWAF01> ags notifications delete <kimlik>
admin@TR7LBWAF01>
Things to Know
- An alarm whose threshold is not given is not produced. The failed login, MFA, lockout and session count alarms work only when a threshold is written.
- The profile must be bound to the gateway. It is bound with the
ags gateway update id <vService> --notificationProfile <profile>command. - The addresses and the numbers are indexed. Every e-mail and telephone is written with its own index; the whole of the list is emptied with
--notifyEmail.deleteor--notifySms.delete. - The values with spaces require quotation marks. The values with more than one word such as the e-mail subject are written with double quotation marks.
