topic ISE operational backup content to syslog instead of backups in Network Access Control

ISE operational backup content to syslog instead of backups

wags — Tue, 19 Jul 2022 17:03:41 GMT

We found this thread: https://community.cisco.com/t5/network-access-control/ise-operational-backup-content/td-p/4184440 where it indicates that the Operational Data Backup contained basically RADIUS and TACACS logs.

We log most RADIUS and TACACS data to syslog from ISE already, which means that the backups are potentially quite a bit of redundant data, and excess storage usage.

What logging options on ISE would allow us to log all the operational data to syslog and then not worry about the operational data backup at all? Is that even possible?

We fully understand that sysylog will require different talents to generate reports than the GUI, but we already have talent in shop and would only need to determine the various record layouts.

ISE v3.1+ patches

Re: ISE operational backup content to syslog instead of backups

Damien Miller — Tue, 19 Jul 2022 17:25:26 GMT

This is pretty easy to do and done quite frequently. It won't be done as a backup but as a new syslog exporter.

Create a new remote logging target here https://<your-ise-node>/admin/#administration/administration_system/administration_system_logging/remote_log
Add the new syslog target to the logging categories here https://your-ise-node/admin/#administration/administration_system/administration_system_logging/logging_categories

Depending on what you want to report from the syslog server you will need to enable those logging categories for export. To start you would probably want aaa authentication failed and passed, aaa radius and tacacs accounting as that's the primary data found within the operational backup.

Re: ISE operational backup content to syslog instead of backups

wags — Tue, 19 Jul 2022 17:44:13 GMT

Thanks for the reply! Do you know where there might be specific Cisco documentation? Something that we can point to for an auditor who might think differently about the subject?

We have those already set up because we have historically used syslog so heavily. Again thanks!

Re: ISE operational backup content to syslog instead of backups

Marcelo Morais — Tue, 19 Jul 2022 22:47:32 GMT

Hi @wags ,

please try the following: Cisco ISE Maintain and Monitor, search for Cisco ISE Logging Mechanism.

Hope this helps !!!