topic Re: Cisco ISE kibana alert after applying 3.2 patch 7 in Network Access Control

Cisco ISE kibana alert after applying 3.2 patch 7

b__k — Tue, 21 Jan 2025 00:26:33 GMT

Recently we recently applied patch 7 to ISE 3.2 to mitigate the issue noted in Field Notice FN74227

Since then I'm receiving alerts about the kibana service not running. As far as I'm aware it was disabled before applying the patch, same as on another ISE instance I'm yet to patch. Show application status of the unpatched (patch 4) ISE instance:

ISE PROCESS NAME STATE PROCESS ID -------------------------------------------------------------------- ISE MNT LogAnalytics Elasticsearch disabled ISE Logstash Service disabled ISE Kibana Service disabled

show application status of the patched ISE:

ISE PROCESS NAME STATE PROCESS ID -------------------------------------------------------------------- ISE MNT LogAnalytics Elasticsearch running 306097 ISE Logstash Service running 309335 ISE Kibana Service not running

How do I disable these services again?

Re: Cisco ISE kibana alert after applying 3.2 patch 7

Greg Gibbs — Tue, 21 Jan 2025 05:29:34 GMT

Disable the Log Analytics feature - https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/admin_guide/b_ise_admin_3_2/b_ISE_admin_33_maintain_monitor.html?bookSearch=true#Cisco_Concept.dita_6903790d-f80e-49e0-9ee8-ce2a1b9c5f74

Re: Cisco ISE kibana alert after applying 3.2 patch 7

b__k — Tue, 21 Jan 2025 22:39:12 GMT

That was showing as already disabled. Nevertheless, I toggled it on/off, however after clicking save the UI sat there for a long time before returning a http-get error.

I also tried a stop/start of the ISE application on the secondary node but it still tried to start the ELK stack:

Starting ISE MNT LogAnalytics Elasticsearch Service... Starting ISE Logstash Service... Starting ISE Kibana Service... ise-kibana-container failed to start ...

Re: Cisco ISE kibana alert after applying 3.2 patch 7

b__k — Wed, 22 Jan 2025 21:50:50 GMT

I ended up getting TAC involved to fix this. The problem was a duplicate entry in the hosts file for the host itself (!!).

After the engineer got in via a root shell and removed the duplicate line from /etc/hosts the service was able to start and the alert emails have stopped.