Cisco ISE Alarms email notification issues

[Darkmatter]

The thing is that ISE is sending out email notifications to recipients that are not configured.

So we have a specific shared mailbox getting all these notifications while i didn't specify this mailbox at all.

Checked under general Alarm Configuration and Alarm Notification to make sure this mailbox was not addressed and still, it receives the emails.

Administration - System - Settings - Alarm Settings

Alarm specific settings don't have this mailbox configured either, so i'm speechless  ....

How to solve this?

[marce1000]

  - Check the 'mail relay' being used and configured in ISE , and review it's  (email) logs for the mails that ISE is sending , look up if the recipient is as intended , this as a sanity check and or to avoid confusing situations when for instance a user mailbox is forwarded to another user (e.g.), 

 M.

[Darkmatter]

Just checked and looks to be ok, no forwarding of any kind.

Still i see a mail being sent from ISE to a recepient that's not configured in alarm settings anywere .... how to explain that?

[Rodrigo Diaz]

@Darkmatter , I would check which are the alarms that are being notified to mailers that you are saying  , for instance if the mailers you say ,are receiving "Certificate Expiration" warning notification , check that alarm specifically only by selecting the alarm and clicking in edit , you should be able to see if for that specific alarm only you have the mailers that you mention so far . 

Let me know if that helped you . 

[Darkmatter]

Hi @Rodrigo Diaz , that's exactly what i already did, just to make sure and check the recipients for this alarm.

But this is the thing, the recipients that is receiving an email from this alarm is no longer configured, although he was before, but not any longer. So it looks like visually all is ok, but in backend the old settings are kept.

[Aref Alsouqi · Accepted solution]

Sounds to be a buggy behaviour, I found this bug, not sure if this is related to your version:

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvx78643

If you are not on the latest recommended release, I would recommend upgrading to the latest recommended. If you are already on the latest recommended then I would recommend to raise this with TAC.

[Darkmatter]

Thanks for the heads-up @Aref Alsouqi. Sounds exactly the issue i'm facing.

Running 2.7 p8 latest patch, but planning to upgrade to 3.1 in the coming weeks.

Hopefully it will be fixed by then.

[Darkmatter]

Despite the fact i upgraded to ISE 3.2, the issue is still there.

[ffischer]

Fixed versions listed should be:
3.0.0.458-Patch3,
2.7.0.356-Patch5,
2.6.0.156-Patch10

just upgraded a 2 Node deployment from 2.6p12 to 3.1p7.
There were no mails sent with 2.6p12,
but now issue can be observed in 3.1p7.

Still ?
Or maybe again ?

Ok, Cisco...
ISE 3.1 may not be listed as fixed...
but one may dare to dream....

asked end customer to open a TAC Case with Cisco

[rakeshdalvi · Accepted solution]

@Darkmatter 

Just out of curiosity, could you please check the email addresses listed in your alarm email? Then, verify them with the Cisco ISE admin accounts under **Administration > System Admin Access > Administrators > Admin Users** to see if there is a corresponding account with those email addresses.

If you find a match, verify whether the "Include system alarms in mails" option is enabled for that account. Try disabling that checkbox and observe whether the alarms continue to be sent.

Let me know if that helped you !

Regards,

Rakesh

[Darkmatter]

This was exactly it. After removing the checkbox, mails stopped coming into the mailbox i wasn't expecting them. I had no clue about that.

Thanks a ton Rakesh!