Any way to filter Passive ID from logs?

[Dustin Anderson]

We have some service accounts that log in way to much and i'm wondering if these are causing my issues. I've started seeing these warnings in the deployment.

ISE Monitor node(s) is about to exceed the maximum amount of allocated RADIUS disk space.

I've added to the collection filter, but not sure if that is working for passive ID.

We are currently on version 2.6, but updating to 3.1 on Saturday.

[ahollifield · Accepted solution]

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/pic_admin_guide/pic_admin31/pic_admin31_chapter_011.html#task_E9787621FE1146E59A0E5EC4573609EE

[Dustin Anderson]

Perfect, hopefully reduce some load, should not be at 460 Million repeat counts.

[ahollifield]

Wow…. I don’t think passive ID logins contribute to this. Looks like you have a lot of misconfigured supplicants or you don’t have repeat suppression enabled in ISE.

[Dustin Anderson]

for RADIUS, I have suppress successful, but I think most are coming from Passive ID. Maybe something in 2.6, we are going to 3.1 on Saturday, so may clear some of this up.