Message Catalog Severity Level

baker82 — Fri, 01 Nov 2019 22:26:17 GMT

We have our ISE deployment pushing logs to a splunk server. We are looking at message class "PSN-Heartbeat" and noticed that message code in this class have a severity level of "Notice".

We are interested in the following message codes:

60057 (A PSN node went down)

60058 (Initial Status of heartbeat system)

The issue here is that the system and operational logging category in ISE has a severity level of "INFO". These message class has a severity level of "Notice" there for its not being pushed to the log servers. There is not an option to reduce the logging option to Notice so the splunk server can pick up the triggered message_code.

The object here is to get a Splunk log that identifies the status of each of our PSN nodes. Especially when one of our PSN nodes goes down.

Can the message catalog have its severity levels changed? and if so, how?

Re: Message Catalog Severity Level

howon — Sat, 02 Nov 2019 07:09:06 GMT

NOTICE is hidden level between WARN and INFO. If INFO is selected, you should get all logs including NOTICE. You can't change log levels of individual messages, but can change per catalog by going to Administration > System > Logging > Logging Categories.

Re: Message Catalog Severity Level

iambelik1 — Fri, 29 Jan 2021 19:29:03 GMT

//del sorry old thread

topic Re: Message Catalog Severity Level in Network Access Control

Message Catalog Severity Level

Re: Message Catalog Severity Level

Re: Message Catalog Severity Level