topic Re: ISE Profiler & Passed Authentications Logs in Network Access Control

ISE Profiler & Passed Authentications Logs

Dolevha — Sun, 20 Feb 2022 13:01:19 GMT

Hey,

I want to understand when each of the ISE logs categories Profiler & Passed Authentication occur.

I assume the Passed Authentications occur every new authentication of an endpoint, but I don't quite understand how ISE decides whether to write a Profiler log for an authentication.

I looked into it and Passed Authentications has much more records, while the Profiler has very few records, and is written once every 10 minutes. I do see the same device getting the same attributes in the profiler log over and over again, without getting a new profile.

Can anyone help me with that?

Thanks in advance,

Dolev

Re: ISE Profiler & Passed Authentications Logs

thomas — Sun, 06 Mar 2022 21:22:18 GMT

A "passed authentication" happens when a user or endpoint successfully authenticate.
I don't understand exactly which logs you are referring - Maybe you are viewing logs from the CLI? Please specify which ones. Provide examples.

Unclear what your profiled endpoint types are and how they may be different from what you are expecting.

See for the next post.

Re: ISE Profiler & Passed Authentications Logs

Netmart — Tue, 01 Apr 2025 00:45:43 GMT

Hello Thomas,

Next to "passed authentication" I am wondering whether it is possible to filter for authorizations.

Please advise.

Thanks,

Martin