Browse documentation
Reading the access log
Network Access (under Operations) is the estate-wide authentication log. Every endpoint also has its own Network access tab showing just that machine's history.
The summary
Tiles across the top cover the recent window:
| Tile | Shows |
|---|---|
| Authentications | Total in the window. |
| Failed | How many didn't get on. |
| Unique MACs | Distinct hardware seen, and how many of those JOATOS already knows. |
| Admin logins | Administrative authentications, which are worth watching separately. |
| Unrecognised MACs | Hardware that authenticated but isn't in your inventory. |
Unrecognised MACs is the one to watch. It's the gap between what's on your network and what you're tracking — either something arrived that you don't know about, or your inventory is behind.
Searching
Filter by MAC (any format), user, access device (the switch or AP, by name or IP), port, SSID, record type, result, and a time window.
The access device and port fields are what make this useful during an incident: they answer where something connected, physically, rather than just that it did.
Not everything is a device
Some records are for things that aren't machines in your inventory — administrative logins, for instance. These are labelled honestly rather than being forced into a device shape, so don't expect every row to link to something.
The endpoint tab
An endpoint's Network access tab narrows all of the above to that one machine: how it authenticated, from where, and whether it's been failing. It's the fastest way to answer "why can't this laptop get on the wifi".
Notes & tips
- A device that ClearPass knows about but JOATOS doesn't won't have live state — see Setting up ClearPass § Known limits.
- Failed authentications are kept for 14 days only. If you're investigating an intermittent problem, don't wait.