topic Re: Failed Authentication Report with Endpoint IP in Network Access Control https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514052#M519753 <HTML><HEAD></HEAD><BODY><P>Thanks that solves de-duplication (somewhat) and the IP problem. <STRONG>Is there anyway to export more than 1000 failed authentication logs from ISE at a single point in time?</STRONG></P></BODY></HTML> Mon, 20 Nov 2017 15:40:35 GMT bilclay 2017-11-20T15:40:35Z Failed Authentication Report with Endpoint IP https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514050#M519749 <HTML><HEAD></HEAD><BODY><P>ISE Teams,</P><P></P><P>What is the best report to export a De-duplicated list of 5,000+ endpoint IPs that are failing authentication?</P><P></P><P>My customer needs:</P><UL><LI>Export over 5000 logs</LI><LI>Logs with similar endpoint MAC de-duplicated</LI><LI>Shows endpoint IP address</LI></UL><P></P><P>This is help with switch from monitor or low-impact mode.</P><P></P><P>Thanks!</P><P></P><P>Bill III</P></BODY></HTML> Thu, 16 Nov 2017 19:53:44 GMT https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514050#M519749 bilclay 2017-11-16T19:53:44Z Re: Failed Authentication Report with Endpoint IP https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514051#M519751 <HTML><HEAD></HEAD><BODY><P>Many network devices (e.g. Cisco WLC) would not allow DHCP until auth success. Anyhow, after exporting the reports to a CSV in a repo, we may use UNIX/Linux/BSD/macOS CLI commands awk and "sort -uf" to get unique data in a field; e.g. I exported a report on RADIUS error to my repository and then use the following to </P><P></P><PRE __default_attr="plain" __jive_macro_name="code" class="jive_text_macro jive_macro_code _jivemacro_uid_15108703643754575" jivemacro_uid="_15108703643754575" modifiedtitle="true"> <P>awk -v FPAT="([^,]+)|(\"[^\"]+\")" '{print $20}' RptExp_testAdmin_RADIUS_Errors_2017-11-16_13-30-00.000000040.csv | sort -uf</P> </PRE></BODY></HTML> Thu, 16 Nov 2017 22:14:33 GMT https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514051#M519751 hslai 2017-11-16T22:14:33Z Re: Failed Authentication Report with Endpoint IP https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514052#M519753 <HTML><HEAD></HEAD><BODY><P>Thanks that solves de-duplication (somewhat) and the IP problem. <STRONG>Is there anyway to export more than 1000 failed authentication logs from ISE at a single point in time?</STRONG></P></BODY></HTML> Mon, 20 Nov 2017 15:40:35 GMT https://community.cisco.com/t5/network-access-control/failed-authentication-report-with-endpoint-ip/m-p/3514052#M519753 bilclay 2017-11-20T15:40:35Z