topic Re: ISE Reporting / Audit in Cisco Catalyst Center

ISE Reporting / Audit

TraffB — Tue, 09 Jul 2024 12:13:18 GMT

Hello,

I am looking for some advice on how to run a particular type of report / audit within ISE. For some backstory, we are experiencing some issues with high CPU & Memory. We are also finding there is a lot of latency within the database.

We currently have around 220K endpoints within ISE, while only around 11K endpoints active at any one time.

I was hoping to be able to run an audit and find out how many devices we have that haven't registered for a given time period, say 90 days.

I have been on Dashboard > Operations > Reports but cannot find any section that fits my requirements.

advice is greatly appreciated!

(apologies if this in the wrong community, i could not find anything for ISE!)

Re: ISE Reporting / Audit

MHM Cisco World — Tue, 09 Jul 2024 12:33:18 GMT

try

operation>reports>endpoints and users> currect active session

MHM

Re: ISE Reporting / Audit

klnnnnng — Tue, 09 Jul 2024 12:38:52 GMT

Hi @TraffB,

what kind of deployment and machines are you running?

Have you checked the Reports - > Key Performance Metrics to see what is the request distribution over the nodes or maybe Top N Authentication by Failure Reason?

Be awere that by default ISE keeps the logs for 30 days.

Regards

Re: ISE Reporting / Audit

TraffB — Tue, 09 Jul 2024 12:46:00 GMT

I did try here earlier with the advanced filters, to try and narrow it down to devices that had not registered. Unfortunately, the filter doesn't allow this.

I would have thought this would be possible under operation>reports>endpoints and users>registered endpoints - sadly it is not.

Re: ISE Reporting / Audit

TraffB — Tue, 09 Jul 2024 13:01:02 GMT

Hello @klnnnnng - It wasn't a case of seeing why endpoints had been rejected, it was more to see the last active endpoints.

For example, we have recently swapped out thousands of IP phones, however the MAC's were not removed from the identity group. By being able to see devices that have been inactive for over 90 days, we would then be able to purge these