PAM Manager displays the status of machines(agents) but there must be an option to configure Alerts to send email when a machine/agent goes offline.
Advantage:
if a rouge system admin hard reboots the agent(windows or linux) and then boots the system in maintenance mode(safe mode in windows and runlevel 1 in Linux) and either uninstall the agent or damage the agent by deleting a few files, PAM Admin then at least know that a particular agent is not healthy and no more recording/auditing is possible for that agent.
by: Muhammad S. | over a year ago | Configuration
Comments
also there should be a dedicated *page* where PAM Manager shows all of the offline agents with the status that show since when the agent is offline. When an agent become online even then that *page* shows the offline history/stats of that agent.
I would like to add as an option to notify an alert via SYSLOG. This would help with customers that have a SIEM platform which they can use to manage notifications and alerts based on this event.
I see this Idea more of a solution to a bigger issue which I think we need to possibly create a new idea and manage. I see the bigger issue as "There must be a way to establish real-time monitoring notification with PAM that will provide notification when infrastructure components go offline. Notifications should include eventing in a way that is consumable by monitoring products like SIEMs, as well as self-generated notifications, i.e. email, when other infrastructure monitoring is not available or desired." Thoughts???
Not sure if creating a new idea is warranted if we can use existing one to flesh out the details. But it is important we have something to talk about to customers who want to use the agent capabilities and monitor component status. This seems to be an important feature to have, though I must admit no customer has asked for this (yet..).
Alternatively, this could be tied to the "real time monitoring" idea as this does not seem to be a trivial task and would be worth including as a feature of a "monitoring dashboard" as discussed in the "active user session dashboard" idea.
Idea need attention.