topic External Syslog Sizing ISE in Network Access Control

External Syslog Sizing ISE

hsangral — Mon, 04 Mar 2019 17:13:45 GMT

Hello

Need help in finding the size of a syslog message in case of device Admin function for both Tacacs and radius when syslog are sent to external logging servers

Re: External Syslog Sizing ISE

mnagired — Mon, 04 Mar 2019 23:50:02 GMT

Hi,

Let me know if this is what you looking for??

Number of sessions per day: 4

Number of commands: 10

Message Size /session (KB) = 5kB + Number of commands/session *3kB

Automated access(single script) log size calculation = n Number of devices * 4 Sessions * Message size

E.g. : Log Size for 30k Network devices = 4GB/day

Re: External Syslog Sizing ISE

Damien Miller — Tue, 05 Mar 2019 00:49:48 GMT

What mnagired posted are the published guidelines for log storage. If the deployment already exists then there is an easy method of confirming space. This ISE GUI page will show you what's currently being stored for the past 30 days.
https://<ise ip>/admin/#administration/administration_system/administration_system_backup/data_purging

What actually gets sent to the external syslog server, is everything you see in the authentication details log. No way to change the data that is being sent, only selecting the categories. The message size differs a little bit based on various components of your config because things like network device groups, AD details (number of domains found) etc are different for every deployment.

Re: External Syslog Sizing ISE

Arne Bier — Wed, 06 Mar 2019 02:31:17 GMT

To get an idea of the actual UDP packet, just enable any external syslog logging host (doesn't have to be a valid IP) and then run a tcpdump on ISE PAN node. You will be able to capture the UDP data.