ISE Monitor Node(s) is About to Exceed the Maximum Amount of Allocated

Saran Komgris — Tue, 09 Aug 2022 17:06:10 GMT

Hi,

Alarm Name: High Operations DB Usage

Details: ISE Monitor node(s) is about to exceed the maximum amount of allocated RADIUS disk space

Description: The ISE M&T node(s) are experiencing higher volume of syslog data than expected

So,

Setting for 90 days is ok but as you can see in the first picture data is stored for 360 days (It isn’t purged and stored only 90 days). I found bug CSCvu68240 which symptom is like what I found.

The point is:

After manually purge both RADIUS and TACACS for data older than 90 days, only RADIUS data is purged but TACACS is still stored for 360 days. Please help check if it’s normal behavior or not.

ISE version: 2.6.0.156 Patch 10, running on VM

Thank you.

Re: ISE Monitor Node(s) is About to Exceed the Maximum Amount of Alloc

ahollifield — Tue, 09 Aug 2022 18:39:56 GMT

Unfortunately, I can't help with this specific issue but do you really need/want 365 days of log storage on ISE? Typically its recommended to dump the logs to an external syslog system to avoid issues such as this.

Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2503911.html

topic ISE Monitor Node(s) is About to Exceed the Maximum Amount of Allocated in Network Access Control

ISE Monitor Node(s) is About to Exceed the Maximum Amount of Allocated

Re: ISE Monitor Node(s) is About to Exceed the Maximum Amount of Alloc