topic Re: TACACS Livelog only displays Failed attempts in Network Access Control

TACACS Livelog only displays Failed attempts

mitali02 — Fri, 21 Feb 2020 18:46:50 GMT

I am deploying Cisco ISE 2.3.0.298 for Device administration in our network. We have a Distributed deployment with one node Primary Admin node and second node Primary Monitoring node. I have Base license and Device admin license installed.

I did a Manual failover test for PAN which didn't go quite as expected. I had to Deregister and Register the node to revert back to the Original setup. I had to also add the Licenses again after this.

Since this change, TACACS livelogs have stopped displaying Successful AAA attempts. It only shows Failed Authentication attempts. I already verified that AAA is actually working using TCP dumps. I am logging in as Super admin with full permissions.

It seems like a License issue or a Logging level issue. I checked both of them and everything seems like the previous setup. Has anyone seen a similar issue in their deployment?

Re: TACACS Livelog only displays Failed attempts

Jatin Katyal — Tue, 27 Feb 2018 18:08:55 GMT

Can you check inside work centers > device administration > reports > device administration reports > Tacacs Authentication. Let me know.

Re: TACACS Livelog only displays Failed attempts

mitali02 — Tue, 27 Feb 2018 22:05:23 GMT

It only shows the Failed attempts that are visible under Livelogs. Before I tried the Manual failover, I could see all attempts under Tacacs Auth, All accounting statements under Tacacs Acct, etc.

Re: TACACS Livelog only displays Failed attempts

mitali02 — Mon, 12 Mar 2018 13:55:07 GMT

Hi Jatin,

Do you have any other suggestions to fix this issue? I have Base with Device Admin license running on my node. Could you please confirm if there is some additional License needed? I am running out of Options with this behavior.

Thanks.

Re: TACACS Livelog only displays Failed attempts

mitali02 — Fri, 30 Mar 2018 11:08:35 GMT

Finally managed to get this issue fixed! I opened a TAC case and the engineer reported we are hitting the bug CSCvd79546. Some logging categories are deleted and so those logs are not reported. TAC engineer ran a SQL script to add those categories.