Aruba Mobility Controllers sample event messages
Use these sample event messages to verify a successful integration with IBM QRadar.
Important: Due to formatting issues, paste the message format into a text editor and
then remove any carriage return or line feed characters.
Aruba Mobility Controllers sample message when you use the Syslog protocol
The following sample event shows a user authentication has succeeded.
<141>Mar 20 10:48:41 2014 aruba.mobility.test authmgr[3469]: <522008> <NOTI> <Test-1 192.168.94.12> User Authentication Successful: username=user1 MAC=00:00:5E:00:53:01 IP=10.124.163.132 role=role1 VLAN=123 AP=Test-A/Test-B SSID=testID1 AAA profile=testID1_AAA auth method=802.1x auth server=test_server
| QRadar field name | Highlighted values in the event payload |
|---|---|
| EventID | authmgr_noti_user_auth extracted from the Event ID field in QRadar |
| Username | User1 |
| Source IP | 10.124.163.132 |
| Source MAC | 00:00:5E:00:53:01 |
| Device Time | Mar 20, 2014, 10:48:41 AM |