Alarms: Log Collection Error on Primary Admin device.

[DigiDen]

Afternoon, new issue on our ISE setup.  All services are working fine, but I can no longer see the Live logs (although thats intermitting), if I can see them, I cant search or filter in them.

I have stopped and restarted the service on the ISE primary Admin node.

We have 2 admin nodes and 2 policy nodes.

SNS-3655-K9 - 3.1.0.518, patch 8

The error is:-

Alarms: Log Collection Error

Description The ISE M&T collector process is unable to persist the audit logs generated from the Policy Service nodes Suggested Actions This will not impact the actual functionality of the Policy Service nodes, Please contact TAC

Apr 15 2025 12:20:53.306 PM

Log collection error : Server=ourISEserver; Log Type=SecureSyslog : Pool not open

Anything else to try before raising a TAC?

Thanks

[Mark Elsen]

               - FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf50026

   M.

[DigiDen · Accepted solution]

After a further bit of investigation, the secondary admin box was in an initialising state, a stop/start was performed on this box too.  As soon as the service were stopped on the secondary the logs re-appeared on the primary admin box.  Part of me thinks this might just be coincidence! (lack of patience more like!)

Will keep an eye on things.