Introduction

If the alert "LDAP connection lost" is enabled, then the alert will be triggered if the conditions details in the alert parameter "Conditions" are met, and are normally triggered when the system detects a loss of connection between DualShield and the external AD/LDAP server cluster.

Upon detection of the loss of connection the alert may then send notification to specified recipient users and groups.

The alert can be found by navigating to "Administration | Alerts", then scrolling down to the alert "LDAP connection lost";

Editing the Alert

The alert can be edited by left clicking on the context menu of the alert and selecting "Edit";

A new window will now open titled "Alert - Edit";







This checkbox is ticked if the alert is to be enabled.




Enter the name to be assigned to the alert within the management console.




Enter a description of what the alert will do.




When the alert is triggered, and when a message is sent, this property will specify who was the sender of the notification.




This section allows you to specify which users are to be sent the notifications.







This section allows you to send notifications to all users that are members of the specified group.







If this checkbox is ticked then a copy of the notification is also emailed to the user that was the subject of the logged event.




We can use the condition builder (via the pencil icon "") to specify what conditions determine if a carbon copy is sent.






If this checkbox is ticked then the alert will send a message using the specified delivery channel.




The "Email" and "SMS" checkboxes can be used to specify which of these two delivery channels are available for use for notification sending.





Additional recipients of the notification may be added here.




Email priority settings can be set either to "High", "Normal" or "Low".






The supplied message subject will be added to the subject header of the notification messages sent to the users.




We use this parameter to specify what message is sent as a notification when the alert is triggered, and may include the following wildcards;

  • [[loginName]] : User's login name
  • [[domainName]] : Domain's name
  • [[applicationName]] : The name of the application
  • [[tokenSerial]] : Token's name
  • [[agentName]] : Agent's name
  • [[serverName]] : The name of the DualShield server
  • [[clientIp]] : The IP address of the requesting client
  • [[logDate]] : The time when this event happened
  • [[eventCode]] : The code of the event








This flag is used to indicate if tasks are to be run when the alert is triggered.




We use this field to specify which tasks are run when the alert is triggered.




The alert is disabled by default, but can be enabled by ticking the checkbox "Enabled";

Specifying Alert Recipients

When the alert is triggered you have the option to send a message to specified recipients using the "Recipient Users" and "Recipient Groups" parameters.

Using the "Condition Builder" tool to determine when the alert is triggered

The "LDAP connection lost" alert is triggered whenever LDAP connections are lost, but you might not always want notifications to be sent to your specified users every time this event occurs.

The "Conditions" parameter is to provide a mechanism by which additional restrictions can be checked prior to send the alert notification.

To edit the conditions that determine when the alert is trigged click on the pencil icon () causing a window titled "Condition Builder" to open;

Sending Notifications

Provided the alert is enabled, the send message is selected, and one or both delivery channels have been enabled, then when a alert is triggered, message notifications will be sent to the selected users (or groups of users)

The default message sent for this alert is as follows;

Hi, administrator,

    Your DualShield Server ([[serverName]]) has lost its connection to your AD server.
    [[description]]

Regards,
DualShield

Adding task execution to the alert

After the alert is triggered you have the additional option to cause one of the existing tasks to be run.

To add task execution to the alert you need to first tick the checkbox prompted "Execute Task", then select what task (or tasks) are to be executed using theicon;