topic Re: How to check logs for system changes in Network Access Control

How to check logs for system changes

techmgr.aballesteros — Fri, 09 Aug 2019 04:36:20 GMT

Hi gents,

Can you please help me how to figure out how exactly to check system changes and logs in ISE 2.4.

For e.g. I want to know how a Network Access User (name: APISponsorMgr see attached file) under Identity Management was disabled 5 days ago. It was originally enabled, I just re-enable it today.

Re: How to check logs for system changes

Charlie Moreton — Fri, 09 Aug 2019 13:30:16 GMT

Interesting. I just checked this out, using ISE 2.4 Patch 9.

First, I created the user APISponsorMgr and while creating I set the password and Administrator Group (ERS Admin). I then went to Operations > Reports > Audit > Change Configuration Audit, and I can see the creation of the account as shown below.

Great, this is working as expected, so I disabled the account and checked the Change Configuration Audit report again, but there was no change. I tried the following:

Refreshed the page
Closed the browser window and tried again
Tried different browsers (Chrome, Firefox, Edge)

to no avail.

Clicking the links for Changed Configuration in the report only show the password being set and the group assigned (after the initial creation)

Checking the Operations > Reports > Audit > Internal Administrator Summary didn't help either. Selecting the Configuration changes icon under the admin I used to create and disable the account only brought me back to the Change Configuration Audit, but only for that admin and with no additional information. It seems there is no way to actually audit the changes to internal users other than creation and deletion.

I suggest working with TAC to file an enhancement request.

Re: How to check logs for system changes

Damien Miller — Fri, 09 Aug 2019 16:10:39 GMT

I had the same "lack of results" as you when I looked last night, a ghost change.

Re: How to check logs for system changes

techmgr.aballesteros — Mon, 12 Aug 2019 03:46:04 GMT

@Charlie, thanks for confirming this, very thorough!

Re: How to check logs for system changes

techmgr.aballesteros — Mon, 12 Aug 2019 03:45:25 GMT