How to check logs for system changes

[techmgr.aballesteros]

Hi gents,

Can you please help me how to figure out how exactly to check system changes and logs in ISE 2.4. 

For e.g. I want to know how a Network Access User (name: APISponsorMgr   see attached file) under Identity Management was disabled 5 days ago. It was originally enabled, I just re-enable it today.

[Charlie Moreton · Accepted solution]

Interesting.  I just checked this out, using ISE 2.4 Patch 9.

First, I created the user APISponsorMgr and while creating I set the password and Administrator Group (ERS Admin).  I then went to Operations > Reports > Audit > Change Configuration Audit, and I can see the creation of the account as shown below.

Great, this is working as expected, so I disabled the account and checked the Change Configuration Audit report again, but there was no change.  I tried the following:

• Refreshed the page
• Closed the browser window and tried again
• Tried different browsers (Chrome, Firefox, Edge)

to no avail.

Clicking the links for Changed Configuration in the report only show the password being set and the group assigned (after the initial creation)

Checking the Operations > Reports > Audit > Internal Administrator Summary didn't help either.  Selecting the Configuration changes icon under the admin I used to create and disable the account only brought me back to the Change Configuration Audit, but only for that admin and with no additional information.  It seems there is no way to actually audit the changes to internal users other than creation and deletion.

I suggest working with TAC to file an enhancement request.

[Damien Miller]

I had the same "lack of results" as you when I looked last night, a ghost change.

[techmgr.aballesteros]

@Charlie, thanks for confirming this, very thorough!