Multiplicated session directory objects in pxGrid session feed

mbisko — Mon, 09 Mar 2020 21:36:19 GMT

Hello,

for our project we use session information feed from pxGrid. Everythink is ok except session information content.

For some messages, mostly DISCONNECTED status, we receive the same information several times:

We receive this feed from ISE-PIC, 2.4.0.357, patch 9. ISE-PIC is fed by syslog from production ISE.

username and domain details are changed but I can privately provide full logs.

Interestingly all record contain the same timestamp but they are sent at different times. These are kind of "bulk updates" that contain more session objects in one shot.

Also I have observed that the duplicates are sent in 5 minutes interval and I have seen it in other few debugged cases as well:

2020-03-09 15:20:16.1997

delta 1:30 min (if this interval is always 1:30, I cannot prove)

2020-03-09 15:21:36.2273

delta 5 min

2020-03-09 15:26:36.3338

delta 5 min

2020-03-09 15:31:36.4542

I have also confirmed from ISE logs that the objects are for sure sent by ISE.

2020-03-09 15:20:16.1997->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX", "providers": ["Syslog"], "endpointCheckResult": "none", "endpointCheckTime": "2020-03-09T15:20:15.082+01:00", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}]}
2020-03-09 15:21:36.2273->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX, "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}
2020-03-09 15:26:36.3338->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX, "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}
2020-03-09 15:31:36.4542->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX", "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}

Is this ISE bug? Or something that we should count with and which has its reason?

Thank you for your help, Martin

topic Multiplicated session directory objects in pxGrid session feed in Network Security

Multiplicated session directory objects in pxGrid session feed