Logging and SNMP Trap Notification Of Events. Isonas Access Control System. Release 12 June 2007

Transcription

1 Logging and SNMP Trap Notification Of Events Release 12 June Gunpark Drive. Boulder, CO (303)

2 Background and Introduction This specification describes and defines the Logging and SNMP interface for the Isonas Access Control system. The interface has access to the database of the Isonas software system, and will provide Ascii logging, SNMP 11 traps to a designated destination and/or will execute a specified program whenever a significant event is recorded within the Isonas Access Control system. The information provided with the logged record, trap or the argument passed to the executed program will identify the nature of the significant event as described below. Significant Events The Isonas Access control system may encounter/generate the following significant events; Event Admit Operations Admit ARM Dual Authorization Reject Reject Antipassback Reject Expired Reject Over Limit Reject TAMPER LOCKED UNLOCKED NORMAL RESET LOCAL RESET UNAUTHORIZED OPEN ALARM Explanation A badge was presented at a controller and the system accepted the badge and unlocked the lock. The badge was authorized to operate the lock at the date/time it was presented and there were no overriding comnsiderations. The system will leave the lock unlocked for the programmed LATCH INTERVAL, typically 3 to 10 seconds, and then relock it. An authorized operator of the Access Control System has issued a command to the controller to Admit. The first of two authorized badges has been presented to a controller that requires Dual Authentication. A badge was presented at a controller and either was not authorized at the date/time or was rejected because of overriding considerations (explained below). A badge was presented at a controller but the system had been configured to define some controllers as Inbound and others as Outbound, and had been further configured to reject a badge if it were presented a second time at an Inbound controller without having been presented at an Outbound controller. An expired badge has been presented. A badge that has exhausted its authorization count has been presented. The reader controller is in a TAMPER alarm condition and rejects badges which have been presented. The controller has been put in LOCKED MODE 2 by. In LOCKED mode, the controller will reject badges even if they would otherwise be accepted unless the badge is defined as a MASTER badge for the controller in question. The controller has been put in UNLOCKED MODE. In UNLOCKED mode, the lock is unlatched and no badge is required for entry. The controller has been put in NORMAL MODE. In normal mode the controller will keep the lock latched until an Admit Event occurs. The controller has been put into LOCAL mode. In LOCAL mode the controller is not polled but is asked if any access events have occurred approximately every 15 seconds. The controller detected that the controlled access point (door/gate/etc) has been physically opened even though the system did not command it to unlock. The access point has been broken into. 1 Simple Network Management Protocol, for more information about SNMP visit 2 A controller can be put in LOCKED, UNLOCKED and NORMAL modes by 1) an authorized operator of the access control system issuing the appropriate commad 2) Programming which defines the actions to occur at the beginning and end of defined shifts or 3) Presenting badges which have been defined to have special properties for the specific controller. 2

3 REX ALARM AUX OPEN TOO LONG TAMPER CONTROLLER FAILURE COMMUNICATIONS FAILURE Clear Alarm INPUT POINT TRUE INPUT POINT FALSE A REX (Request for Exit) signal was received and the controller had been programmed to create an alarm condition for REX inputs. An AUX (Auxiliary Input) signal was received and the controller had been programmed to create an alarm condition for AUX inputs. A valid badge was presented and an Admit action was performed, but once the controlled access point was opened it remained open for longer than the programmed time interval. (The programmed interval can be made indefinite.) An internal tamper detection mechanism has been tripped. The controller case has probably been broken. The controller has failed to respond to commands. Some other failure has been detected in the communications system. The failure is not associated with a specific controller but may be associated with a single subnet or with all subnets being managed by a given server. The alarm condition has been cleared, either by an authorized operator using the Clear Alarm function in the Monitor module or by the presentation of a badge with the Clear Alarm special property for the controller An input point has turned from FALSE to TRUE and the system is configured to log that event to the history file An input point has turned from TRUE to FALSE and the system is configured to log that event to the history file TrapGen The TrapGen program is available as freeware 3 and provides a convenient and flexible way to generate SNMP Traps. The command line parameters for the program are reproduced here from the README document that accompanies the download. Other command line parameters: -d destinationipaddress:port e.g., -d :1025 -c communityname e.g., -c private -o senderoid e.g., -o i senderip e.g., -i g traptype e.g., -g 5 -s specifictype e.g., -s 23 -t timestamp e.g., -t r requestid e.g., -r 42 -m timeout e.g., -m 10 In addition, you can specify varbinds to be added with the -v switch: -v oid TYPE value where: oid is the object id of the variable TYPE is one of the following: STRING 3 See 3

4 COUNTER GAUGE INTEGER ADDRESS OID TIMETICK HEX and value is the value to associate in the varbind Architecture of Event Logging and SNMP Interface The Isonas Logging and SNMP Notification program provides a configuration program which allows each of the Significant Events listed to be logged and/or to create an SNMP Trap with a specified value for each of the above parameters except for the I senderip value. The senderip value is the IP address of the Subnet for which the event is being reported. If only one controller is attached to a TCP/IP thin server (Subnet), then the above information is sufficient to uniquely identify the location for which the event is being reported. The controller ID (a one byte value in the range 01hex to FE hex) is reported using the varbind facility. This is needed to uniquely identify the source of the significant event when more than one controller is attached to a TCP/IP subnet. The BadgeId (a 4 byte value) is also reported using the varbind facility. The UniqueId (a 4 byte value) is the unique identification of the person to whom the badge is currently assigned. This is reported along with the badgeid using the varbind facility. Logging (Ascii) The configuration program allows the user to specify the name and location of the ascii logfile by giving its fully qualified pathname. If only a filename is given, the current directory is assumed. If logging is enabled for an event, the following fields are output to the ascii file in CSV (comma separated value) format: EventDate, EventTime, EventDescription, BadgeId, UniqueId, ServerId, SubnetId, ControllerId, DoorName Program Invocation on Events The configuration program also allows you to specify a program which will be run whenever an event is generated. Fields that are listed above are passed as a parameter string to the program. 4

5 User Interface Here is the screen which is displayed when you invoke the SNMPIF program. The screen has a counter that will count down to zero and then restart from the user settable Event Interval (default = 5 seconds). Each time the counter reaches zero the system looks for new events that have occurred and performs any logging, SNMP trap generation or program invocations that have been configured. Here is the Configuration screen: 5

6 The events which are possible are listed on the left. For each event, you may select any or all of the three possible actions by checking the appropriate checkbox in the middle of the screen. If you select Trap Event, you must use the right hand side of the screen to configure the trap event to be generated. If you choose Log, the location of the Log File is shown at the bottom of the screen and may be modified as necessary. If you choose Run Command, the name of the program to be executed is shown at the bottom of the screen. The Configure menu option also has choices to install or uninstall the SNMPIF program as a windows service. The Test screen shown below will allow you to create any of the events for the selected reader controller 6

7 7 Logging and SNMP Interface