topic Re: Questions about logs and API in Network Access Control

Questions about logs and API

ckli — Tue, 09 Oct 2018 02:24:16 GMT

Hi Experts,

Our customer has asking some questions about the ISE as below:

1. How can the customer run the accounting report(per IP address) over 30days? For example, the customer just can get "last 30 days" data of RADIUS accounting from report.

2. Does our API support policy deployment? The customer need some tasks automatically.

Re: Questions about logs and API

Arne Bier — Tue, 09 Oct 2018 03:17:12 GMT

Good question. I never thought about this - also makes me wonder how that impacts the Data Retention Period settings below. I always thought that this was set to the maximum number of days that you would run a report on. But if reports are only up to 30 days, then one might want to purge anything older than 30 days too, and not 90?

I know the answer to question 2: No support for Policy Set configuration via REST API. Others have also asked for this. Seems like a reasonable request. Cisco will tell you to speak to your account team or to submit a Feedback request via the ISE GUI

Re: Questions about logs and API

ckli — Tue, 09 Oct 2018 03:32:13 GMT

Hi Arne，

Thanks for your prompt response! For question 1, I tried to change the Data Retention Period to 90 days.

The max time range of the report is still "last 30 days". Is there a way to have a custom time range of the report?

Re: Questions about logs and API

Arne Bier — Tue, 09 Oct 2018 04:46:53 GMT

Let's see if any of the ISE TME's can comment on that. You can try reaching out internally to Jason Kunst (ISE TME) and then reply on this forum

Re: Questions about logs and API

Damien Miller — Tue, 09 Oct 2018 06:15:23 GMT

I've forgot what the reporting GUI looks like now pre 2.4, but you can run custom date range reports greater than 30 days from the reporting section in 2.4, it would just depend on the radius retention policy you included a screen shot of. The drop down gives the canned longest option for last 30 days, but custom is there.

If there was a hard requirement for data like this I would build a SQL server to store the information. Export it daily from ISE on a schedule and automatically import it in to a SQL DB. You could build a web app on top of it much easier.

Re: Questions about logs and API

Arne Bier — Tue, 09 Oct 2018 06:25:06 GMT

@Damien Miller

I increased my retention from the default 30 days to 60 days, but I still don't see an option for custom.

Do you have that option in ISE 2.4 ? I am on patch 3

My system was originally built with 2.2 and upgraded to 2.3 and now 2.4. Sometimes upgrades cause corruption.

Re: Questions about logs and API

Damien Miller — Tue, 09 Oct 2018 06:31:59 GMT

It's not very intuitive, hit the advanced filter.

Re: Questions about logs and API

Arne Bier — Tue, 09 Oct 2018 07:06:56 GMT

ISE is clearly not idiot proof 😞

thanks for the tip!