topic Re: How to stop Cisco Prime from spamming ISE TACACS logs? in Network Access Control

How to stop Cisco Prime from spamming ISE TACACS logs?

enzo80 — Tue, 07 Dec 2021 19:23:50 GMT

Cisco Prime keeps spamming TACACS logs with user Authorization every 2 seconds

type: Authorization message: Device-Administration: Command Authorization succeeded

Re: How to stop Cisco Prime from spamming ISE TACACS logs?

balaji.bandi — Tue, 07 Dec 2021 20:02:02 GMT

you do not like that change the audit logs :

https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-7/admin/guide/bk_CiscoPrimeInfrastructure_3_7_AdminGuide/bk_CiscoPrimeInfrastructure_3_7_AdminGuide_chapter_01000.html

Re: How to stop Cisco Prime from spamming ISE TACACS logs?

Rob Ingram — Tue, 07 Dec 2021 20:23:37 GMT

@enzo80 you could either amend the prime configuration. From ISE itself, you can also configure a collection filter on ISE to suppress messages from certain device ip address, username, mac address or nas ip address. In your instance you'd configure the prime server IP address.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_maintain_monitor.html#ID162