topic Cisco ISE continuous Alarsm on every 2 minutes in Network Access Control

Cisco ISE continuous Alarsm on every 2 minutes

pemasirid — Mon, 11 Mar 2019 02:09:59 GMT

Hi,
We have cisco Identity Service Engine (ISE) with Active/Standby deployment with the version 1.1.0.665 on both.

We can see the number of alarms geneated so far in >60000 and every 2 minutes time we get one alarm on the dashboard saying "Alarm caused by ISE - System Health Issue".

Can anyone please advise what is the exact reason, whether it is false alarm, will this affect for the live users, is there a patch to resolve this issue?.

Please see the attached are taken from the ISE.

thanks in advance..

Cisco ISE continuous Alarsm on every 2 minutes

jrabinow — Tue, 05 Jun 2012 19:29:35 GMT

I am not sure either of the screen shots show the reason for the alarm

Do the following:

- display teh alarms window

- click on the test "ISE System Health"

- it will tell which message caused the alarm condition

Cisco ISE continuous Alarsm on every 2 minutes

pemasirid — Wed, 06 Jun 2012 14:05:32 GMT

Hi,

Please find attached screenprint for details of alarm, seems like the disk utilization issue or not sure whether actual issue or costmatic.

Appreciate if you can give us any resolution for the same.

thanks in advance.

Cisco ISE continuous Alarsm on every 2 minutes

jrabinow — Wed, 06 Jun 2012 20:07:18 GMT

This alarm is reported due to /localdisk being full. /local disk is not critical to ongoing ISE operations and ma contain some core files or other data. /opt directory would be more of more concern since stores operational data

The issue can be addressed as follows from the CLI

Issue following command to se what is in /localdisk

dir disk:/

can delete one of the files that you see as follows (exampleof filename deleteme)

del disk:/deleteme

If you delete below the threshold the alarms should stop

Cisco ISE continuous Alarsm on every 2 minutes

pemasirid — Wed, 06 Jun 2012 20:15:16 GMT

Hi,

Many thanks for your response and time on this.

So what could likely be the files as you mentioned below:

"can delete one of the files that you see as follows (exampleof filename deleteme)

del disk:/deleteme"

Is it something starting deleteme or any file with deleteme, sorry I dont have the output right now and can only check tomorrow, but just want to be more precious on what files can be deleted safely.

Thanks again...

Cisco ISE continuous Alarsm on every 2 minutes

jrabinow — Wed, 06 Jun 2012 20:19:43 GMT

When you issue the dir command you will see a list of files and their sizes

For example

Directory of disk:/
73647 May 17 2012 13:27:46 auth.log
135734648 May 17 2012 10:19:13 file1

1180506216 May 24 2012 14:56:32 file2

16384 May 14 2012 03:37:47 lost+found/
54394 May 16 2012 14:35:36 file3

112368 May 17 2012 13:24:28 file4

279860 May 16 2012 14:16:54 file5

           Usage for disk: filesystem
                 1490849792 bytes total used
                12956958720 bytes free
                15234142208 bytes available

In this case, I can decide to delete file2 since is the biggest and can issue:

del disk:/file2

Cisco ISE continuous Alarsm on every 2 minutes

pemasirid — Thu, 07 Jun 2012 06:44:25 GMT

Hi,

Thanks for the reply. I issue the dir disk:/ and found some files with more capacity being used (*.hprof)

So I just want to re-confrm that can I delete the following files,

159965184 Mar 26 2012 19:55:50 java_pid22723.hprof

1757798744 Feb 23 2012 05:40:44 java_pid25216.hprof

1625805300 Mar 14 2012 10:58:54 java_pid2574.hprof

1210449920 Mar 22 2012 12:56:50 java_pid26700.hprof

1420222971 Feb 28 2012 12:21:13 java_pid31150.hprof

1457394039 Feb 12 2012 09:03:35 java_pid3486.hprof

1551062905 Feb 22 2012 14:09:04 java_pid3534.hprof

127434752 Mar 20 2012 12:07:10 java_pid3544.hprof

1554652188 Feb 19 2012 17:23:57 java_pid3550.hprof

1294055852 Feb 20 2012 13:58:37 java_pid3551.hprof

1281933632 Feb 20 2012 11:17:51 java_pid3554.hprof

1598868128 Mar 07 2012 17:00:28 java_pid6086.hprof

Below is the screenprint of dir disk:/ output.

in that case will there be any effect for the operation of ISE as I'm worry that this is now completely on production with all the users in the network.

Cisco ISE continuous Alarsm on every 2 minutes

jrabinow — Thu, 07 Jun 2012 07:04:02 GMT

Yes. You can safely delete the hprof files without impacting the system operations

Cisco ISE continuous Alarsm on every 2 minutes

pemasirid — Thu, 07 Jun 2012 07:20:58 GMT

Hello,

Thank you very much for confirming that. We will do this weekend and update you accordingly.

Thanks in advance.