cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

661
Views
5
Helpful
3
Replies
Highlighted
Beginner

Cisco ISE condition Log -- possible?

Hi There.

is there a way to have Cisco ISE do condition log ?

for example,  if the login user is "john-doe", do not log any authentication/authorization event?

 

we have some security tools keep login to every device, which create a lot of unnecessary logs.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Hi @Jason_newbie 

If I understand your question correctly, you want to filter authentication messages which appear in the ISE RADIUS Live Log Viewer, right? You can do that with a collection filter.

Go to Administration > System > Logging > Collection Filters then add a filter with attribute User Name and the respective filter type.

View solution in original post

3 REPLIES 3
Highlighted
VIP Advisor

Hi,

You can't do conditional debug on ISE. For this, you will need to have to
have security logging rules on a SIEM/Logging collector.

***** please remember to rate useful posts
Highlighted
Beginner

Hi @Jason_newbie 

If I understand your question correctly, you want to filter authentication messages which appear in the ISE RADIUS Live Log Viewer, right? You can do that with a collection filter.

Go to Administration > System > Logging > Collection Filters then add a filter with attribute User Name and the respective filter type.

View solution in original post

Highlighted

Thanks, this is exactly what I need.

Content for Community-Ad