topic Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup.. in Network Access Control

Empty RADIUS and TACACS LiveLogs after restoring ISE from backup...

rezaalikhani — Wed, 14 Feb 2024 16:45:04 GMT

Hi all;

Yesterday, due to a power outage in our environment, my ISE 3.2 patch 4 crashed and I restored it with the latest backup successfully (only the configuration backup, not the operational backup)... Everything works well except that the RADIUS and TACACS LiveLogs are empty, as you can see below:

The steps that I have taken so far:

1. Disabling the " Use "ISE Messaging Service" for UDP Syslogs delivery to MnT" option.

2. Regenerating a new certificate for "ISE Messaging Service"

3. Regenerating a new certificate for ISE Root CA.

Any ideas?

Thanks

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

Aref Alsouqi — Wed, 14 Feb 2024 16:59:45 GMT

How many nodes do you have in your deployment? and where the MnT personas are enabled?

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

ahollifield — Wed, 14 Feb 2024 17:04:24 GMT

Do you have queue link alarms? Why did you disable the ISE Messaging Service? https://www.adamhollifield.com/2022/09/fix-cisco-ise-messaging-service.html

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

Arne Bier — Wed, 14 Feb 2024 20:05:42 GMT

I had a case yesterday where an ISE 2.7 system just stopped producing any Live Logs. The M&T process had died due to a disk space issue. Somewhere deep in an Oracle database, that TAC engineer found a table that had metastasized well beyond its normal size. The /opt was 80% full. The solution was to Reset the M&T Database.

application configure ise

Option 4.

That reduced the /opt to 20% and all was well again. I have never had to use this option in earnest. But it's a good one to keep in mind. Bear in mind it will restart the application services though.

In ISE 3.2 patch 4 the regen of Messaging CA and Internal CA should resolve any Queue Link errors ... at least in my experience.

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

rezaalikhani — Thu, 15 Feb 2024 05:16:27 GMT

@Aref Alsouqi I have implemented ISE in Standalone mode...

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

rezaalikhani — Thu, 15 Feb 2024 05:22:23 GMT

@ahollifield I do not have any Queue Links error. I disabled that option because many threads in technical communities suggested that disabling it resolved their problems.

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

rezaalikhani — Thu, 15 Feb 2024 05:37:32 GMT

@Arne Bier I used Option 4 as you suggested but it did not resolve the problem...

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

Arne Bier — Thu, 15 Feb 2024 05:50:21 GMT

What does show application status ise show you? Is M&T process running?

Tried rebooting the node?

Are your ISE DNS records still same as before? A and PTR records?

Re: Empty RADIUS and TACACS LiveLogs after restoring ISE from backup..

rezaalikhani — Thu, 15 Feb 2024 06:27:23 GMT

@Arne Bier Some interesting things happened. Honestly, I decided to build my ISE deployment from scratch and so, blindly attempted other options beside your recommended option. Fortunately, the Option 1 --> Reset M&T Session Database did the trick.

Thanks anyway