cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1357
Views
0
Helpful
7
Replies

ISE 2.4 Patch 6 Filtering of Live logs not possible

thomas.pflaum
Level 1
Level 1

Hello,

i have upgraded ISE form 2.3 to Version 2.4 Patch 6. I have used self created Filters for Live Logs, you are lost in logs if you are not able to use it....

Now in Version 2.4 Patch 6 you are able to use the self created filters, but the result of filtering is different than before. I only see Passed/Failed Authentications no Sessions any more. The Filtering is configured to get live logs only for one specific Authenication Policy.

 

The behavior is the same, if i´m filtering for a specific Authenication Polcy in the column in the Live Logs.

If you filter based on the Identity in Live Logs, i see Passed/Failed Authentications and Sessions.

 

Does anybody have this same problem, or i´m doing something wrong?

Thanks

Thomas

 

2 Accepted Solutions

Accepted Solutions

You shouldn't be getting session information when filtering in RADIUS live logs.  If you were getting it in the past, it was most likely a defect that we fixed in 2.4.  To view session information, click the Live Sessions tab.  You can then filter from there.

 

Regards,

-Tim

View solution in original post

Thomas,

 

That is funny.  Those are the two columns I hide and have all my customers hide because for the most part you don't need to use those columns if you have a good naming convention on your Authorization Profiles.  I just unhid them and you are correct blue session records aren't shown when you filter using either of those two columns.  Definitely a bug in my opinion.  Open a TAC case and have them get a bug filed. 

View solution in original post

7 Replies 7

paul
Level 10
Level 10

I only use the quick filter, but I just tried advanced filter with Authorization Profile and I get all record types.  How exactly are you doing the filtering?  I hide my authentication and authorization policy columns and only do filtering on authorization profile column because every result in my ISE deployments has a unique name using a well structured naming convention.

It doesn´t matter which way you are filtering the Data in Live Logs. It´s not working with quick filter. I want to filter for a specific policy set, like you see in the attached screenshot. On old ISE Version (2.3 Patch 5) i have filtered for a specific Policy set, and the result was that i saw all passed, failed Authentication and the Sessions. In New Version (2.4 Patch 6) I only see passed and failed Authentications without the sessions.

You shouldn't be getting session information when filtering in RADIUS live logs.  If you were getting it in the past, it was most likely a defect that we fixed in 2.4.  To view session information, click the Live Sessions tab.  You can then filter from there.

 

Regards,

-Tim

Hey Tim,

filtering inlcuding all Status (session, auth failed, auth passed) works in Version 2.4 in all column´s of the livelogs except of Authentication Policy and Authorization Policy.

I have tried to filter for Authentication Policy and Authorization Policy in Live session tab without success.

This sounds for me like a bug, not a feature.

BR

Thomas

Thomas,

 

That is funny.  Those are the two columns I hide and have all my customers hide because for the most part you don't need to use those columns if you have a good naming convention on your Authorization Profiles.  I just unhid them and you are correct blue session records aren't shown when you filter using either of those two columns.  Definitely a bug in my opinion.  Open a TAC case and have them get a bug filed. 

Paul,

Thank you for you feedback. I already open a Case at Cisco.

BR

Thomas

Hello All,

result from opening TAC case:

 

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp19738/?reffering_site=dumpcr

 

So it is definitely a bug in Version 2.4 Patch 6.

Thanks to all.

BR

Thomas

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: