topic Re: Cisco ISE log in Network Access Control

Cisco ISE log

henokk601 — Wed, 22 Feb 2023 15:42:08 GMT

Hi All,

I have one question regarding ISE log. I want to know the changes that have been made on the ISE configuration and which menu should I go to check the logs?

Re: Cisco ISE log

M02@rt37 — Wed, 22 Feb 2023 15:51:42 GMT

Hello @henokk601

By default, the Audit log retains data for 90 days, but this can be changed in the ISE system settings. Only users with the appropriate permissions can view the Audit log.

On your ISE web Interface click on the "Administration" tab at the top of the page.

Click on "System" in the left-hand menu, then select "Audit Log" from the drop-down menu.

On the Audit Log page, you can select various filters to narrow down the search for configuration changes, such as date range, user, and operation type.

Once you have selected the filters, click the "Search" button to display the log entries. The log entries will display the time and date of the configuration change, the user who made the change, the operation type (create, modify, delete), the object that was changed, and the before and after values of the object.

Re: Cisco ISE log

Greg Gibbs — Thu, 23 Feb 2023 00:38:56 GMT

With current ISE versions, the information you are looking for should be in the Change Configuration Audit report. See the ISE 3.1 Admin Guide (or check the Admin Guide for your particular version) for more information on the ISE Reports.