Cisco ISE 1.4 Internal-sys-user syslog received on Arcsight

[M.Jallad]

Hello Everyone,

I need your assistance and ideas about the following syslog notification received from ISE server on our Arcsight solution :

What is the reason for such a message knowing that it was not triggered an actual configuration change ??

Appreciate sharing your ideas and experience ,

Best Regards,

Muayad Jallad,

[franjean47]

Hello Everyone

We have the same syslog message for that user, we are running 2.6 patch 6

Can anyone supply an explanation of what the internal-sys-user actually does. From my understanding it is used for automatic internal system maintenance processes. 

However we are unable to see what the processes are that the user has done as the descriptions in the logs a a generic " Machine Authentication Settings has been changed for Machine Authentication Settings".

Is there a way that one can check what changes the user has done?

[Marcelo Morais]

Hi @franjean47 

 please double check the

Operations > Reports > Reports > Audit > Change Configuration Audit
Operations > Reports > Reports > Audit > Operations Audit

Hope this helps !!!