topic Re: ISE 1.3 and sending alarms as syslog messages in Network Access Control

ISE 1.3 and sending alarms as syslog messages

smp — Thu, 19 Jan 2017 20:28:24 GMT

Hello, I am running ISE 1.3 Patch 7. I have an application that can consume and search syslog messages and I have ISE configured with this application as a syslog target. That works fine for authentication logs, but none of our Alarms are being sent. I found the snippet below in the 1.3 admin guide but I am completely confused on what this means. This is the key statement:

> If you configure monitoring functions to send alarm notifications as syslog messages

How exactly do I configure alarm notifications to be sent as syslog messages? The only option I have in System > Settings > Alarm Settings > Alarm Notification is email, and I can't seem to find the relevant instructions in the guide.

Thanks.

Log Collection

Monitoring services collect log and configuration data, store the data, and then process it to generate reports and alarms. You can view the details of the logs that are collected from any of the servers in your deployment.

Alarm Syslog Collection Location

Alarm Syslog Collection Location

If you configure monitoring functions to send alarm notifications as syslog messages, you need a syslog target to receive the notification. Alarm syslog targets are the destinations where alarm syslog messages are sent.

You must also have a system that is configured as a syslog server to be able to receive syslog messages. You can create, edit, and delete alarm syslog targets.

Note

Cisco ISE monitoring requires that the logging-source interface configuration use the network access server (NAS) IP address. You must configure a switch for Cisco ISE monitoring.

Re: ISE 1.3 and sending alarms as syslog messages

Craig Hyps — Fri, 20 Jan 2017 00:08:06 GMT

Feature available in ISE 2.1...

Re: ISE 1.3 and sending alarms as syslog messages

hslai — Fri, 20 Jan 2017 05:18:39 GMT

I could not find an ISE 1.3 instance, but here is a screenshot from ISE 1.4.1, that shows [ Include Alarms for this Target ] checkbox option in a remote logging target:

Re: ISE 1.3 and sending alarms as syslog messages

smp — Fri, 20 Jan 2017 13:17:17 GMT

YES, that was it! Thank you so much!!!

Re: ISE 1.3 and sending alarms as syslog messages

Jason Kunst — Fri, 20 Jan 2017 14:42:03 GMT

Now get off 1.3 this release is old

1.4.1 is a controlled release

deployment should be moved to 2.1 which has been out and stable

Re: ISE 1.3 and sending alarms as syslog messages

Craig Hyps — Fri, 20 Jan 2017 17:40:36 GMT

Combining information based on sidebar discussions with Hsing...

Alarms are automatically sent to default system Log targets. If wish to send Alarms in syslog to new external targets, then select option from screenshot that Hsing provided. When add a new target, there is checkbox to optionally include alarms.

Starting in ISE 2.1, you can also selectively choose which alarms are sent as Syslog. System (predefined) alarms are automatically enabled for syslog, but new (custom) alarms are not enabled for syslog by default.

/Craig