topic Re: Queue link error reported in Network Access Control

Queue link error reported

dgaikwad — Wed, 09 Feb 2022 12:02:02 GMT

Hi experts,

Last week, we were able to resolve the Queue link error by following steps provided in one of the Communities article.
But, now while investigating logs from syslog servers not able to find the exact error as its mentioned in the alarms settings on ISE.
Is there any specific error code assigned to this message, so that we can capture such alerts in future.

Re: Queue link error reported

balaji.bandi — Wed, 09 Feb 2022 12:36:42 GMT

can you be more explanation what kind of error you looking : is this related ISE device or router or switch ?

ISE Logs below can help with code :

its based on the config :

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_IntrotoSyslogs.html

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_SyslogsList.html

Re: Queue link error reported

dgaikwad — Wed, 09 Feb 2022 12:40:04 GMT

This error is reported on ISE nodes. And specifically on the alarms dashboard.
I need to track this down in syslogs so that a certain alarms could be setup for it.
I have gone through the above suggested documentation and there is no information for this error there as well.

Is there any specific way to track alarms that are generated from Alarms settings under Administration -> System -> Settings -> Alarm Settings.

Re: Queue link error reported

balaji.bandi — Wed, 09 Feb 2022 13:11:20 GMT

just to make it clear "Is there any specific way to track alarms that are generated from Alarms " - you want to send this to syslog ?

what is the version of ISE you running andf ISE 2.X look at below how you can send logs to syslog server :

https://community.cisco.com/t5/network-access-control/ise-1-3-and-sending-alarms-as-syslog-messages/td-p/3456202

Re: Queue link error reported

Marcelo Morais — Wed, 09 Feb 2022 13:40:02 GMT

Hi @dgaikwad ,

beyond what @balaji.bandi said ...

You are able to check the Queue Link Error Alarm Settings at Administration > System > Settings > Alarm Settings:

and also double check if it will Send Syslog Message:

Hope this helps !!!

Re: Queue link error reported

dgaikwad — Wed, 09 Feb 2022 17:41:07 GMT

All the alarms from the Alarm settings are logged to syslog.
Is there a way find out what the specific alarm looks like in syslogs? In this case it's the queue link error.

Post investigation through all the logs, I was unable to find such message in syslogs.
So, is the queue link error reported with some different error code?

Re: Queue link error reported

dgaikwad — Wed, 09 Feb 2022 17:42:42 GMT

I am able to see them and verify what alarms are configured from this settings page, my query is, with what format is the above alarm reported in syslogs?
Is there is a specific code that I could refer to so that I could configure an alarm on the syslog server's end.

Re: Queue link error reported

balaji.bandi — Wed, 09 Feb 2022 18:18:16 GMT

what syslog server you using :

if you are sending logs to syslog server byu device.

go to syslog log folder

more ise.log | grep queue (see what you get )

Re: Queue link error reported

dgaikwad — Wed, 09 Feb 2022 19:31:06 GMT

The logs are being sent to QRadar, and is there a way to find out what format of this error would be on syslog?

Re: Queue link error reported

Arne Bier — Wed, 09 Feb 2022 22:14:07 GMT

Maybe run a tcpdump on the Admin node (and decode the syslog in Wireshark) while provoking/reproducing the alarm - tricky thing is how to reproduce the issue. Perhaps someone on the forum can recommend a trick?

Re: Queue link error reported

dgaikwad — Thu, 10 Feb 2022 09:46:22 GMT

Initially I had thought of capturing using Wireshark, but then was not able to, now since the error has stopped.
I was looking for a way to find it in the syslog server, to investigate what kind of information was sent in the payload.
Thus using that information to create a new alert based on this issue.

Re: Queue link error reported

thomas — Sun, 06 Mar 2022 00:14:25 GMT

Please ask your very specific and detailed question with specific errors and examples when you ask your question to prevent so much back-and-forth from so many people.

See for your future questions.

All ISE Syslog Messages may be seen, listed, viewed, filtered and exported from the Message Catalog right next to your Syslog Server settings.

Also on Cisco.com: https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_IntrotoSyslogs.html