topic Re: Delete old logs displayed in ISE CLI in Network Access Control

Delete old logs displayed in ISE CLI

hurricane05 — Wed, 21 Jul 2021 08:12:36 GMT

I'm currently running ISE version 2.6 and when I do a show logging from ISE CLI, I see logs dated back from over a year ago. In the GUI under Administration \ System \ Logging the Local Log Storage period is set to 90 days. I also clicked on the button to Delete Local Logs Now. Is there another area where I set to the amount of logs to keep?

Thx in advance for any assistance provided.

Re: Delete old logs displayed in ISE CLI

balaji.bandi — Wed, 21 Jul 2021 13:21:48 GMT

Can you post the output of show logging what files you referrring ?

Re: Delete old logs displayed in ISE CLI

Marcelo Morais — Wed, 21 Jul 2021 16:44:56 GMT

Hi @hurricane05 ,

please take a look at:

ise/admin# show logging ?
>           Output Redirection.
application List application log files
container   Show container logging information
internal    Show syslog configuration internal
system      List system log files
|           Output modifiers.
<cr>        Carriage return.

if you have logs dated from over an year from the:

show logging <cr> ... it's weird

show logging application | show logging system ... possible

Hope this helps !!!

Re: Delete old logs displayed in ISE CLI

Arne Bier — Thu, 22 Jul 2021 05:28:33 GMT

I don't think it's possible to prune all ISE logs - local application logs can be purged I think - but I have a customer whose config backup contains logs from 2014!

ISE drags a lot of junk around. And sadly, the config backup contains all that junk. It pains me every time I see it. I would expect this in a debug bundle - but not in a config backup.

Re: Delete old logs displayed in ISE CLI

hurricane05 — Thu, 22 Jul 2021 07:21:49 GMT

Thx for the feedback. See attached log file. Seems most are from the Application.

Re: Delete old logs displayed in ISE CLI

Arne Bier — Thu, 22 Jul 2021 22:22:22 GMT

Regarding the option in the ISE Admin GUI to clear local logs:

Administration > System > Logging > Log Settings "Delete Local Logs Now"

When comparing the before and after (I compared the "show logging application" with WinMerge for side by side comparison) I noticed that it only cleanses the localStore/iseLocalStore.log.* files - e.g. it wiped only these files

    5243041 Jul 22 2021 05:06:00  localStore/iseLocalStore.log.2021-07-22-00-00-01-377
    5243031 Jul 22 2021 09:53:38  localStore/iseLocalStore.log.2021-07-22-05-06-00-816
    5242937 Jul 22 2021 13:32:29  localStore/iseLocalStore.log.2021-07-22-09-53-38-970
    5243074 Jul 22 2021 17:19:40  localStore/iseLocalStore.log.2021-07-22-13-32-29-828
    5243032 Jul 22 2021 21:54:49  localStore/iseLocalStore.log.2021-07-22-17-19-40-660

ISE does rotate its logs and the regular Linux log rotation stuff happens - it means older stuff might hang around if the newer data is insufficient to overwrite it. But the number of log files stays constant.

Re: Delete old logs displayed in ISE CLI

Ethan Grinnell — Mon, 14 Nov 2022 06:30:15 GMT

If this is a VM you can mount the disks in another VM (Just plain Linux) and delete files as needed. There have been some bugs that left huge log files that I cleaned up this way.

Be careful though! This is also a great way to break things if you're unsure of what you're doing.