Cisco ISE - Configuration Changed Alarm

[Matthew Martin]

Hello All,

Cisco ISE: v2.0.0.306

On the Cisco ISE Homepage under the Alerts section, it's showing an alarm for configuration changed. Now, tyesterday I cleared this alarm which said something along the lines of 300+ configuration changed alarms...

This monring when I logged in it says 3 configuration changed alarms, less then one minute ago. How is this possible? No one other then myself has logged in to ISE since I did yesterday, and even then I made no changes.

If I click into the alrams and choose one of the "Changes" that were made, it doesn't really tell you much... Does ISE consider logging in a "configuration change"? I'm really confused about this?

*Attached screenshot of one of the alarm's details page. All of these "configuration changed" alarms are basically the same thing...

Thanks in Advance,

Matt

[Francesco Molino · Accepted solution]

Hi

Can you clear the alarm, login back and see if you have the alarm again.
There is a known bug in your ISE version:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuh80199/?referring_site=bugquickviewredir

[Matthew Martin]

Hey Francesco, thanks for the reply.

I just looked at your link for the known bug and it's showing MY post as the description in the bug with me as the author. I guess someone there at Cisco found this to be a bug and used my post to create it...

But, I did as you said. I cleared the alarm at 11:48 AM and logged out. I waited about 1 minute and logged back in and the homepage of ISE showed one NEW configuration change alert, less than 1 minute ago, at 11:49 AM... That alert showed the exact same time I logged back in.

So it does look like it's triggering a Configuration Changed alert by simply logging in.

Thanks Again,

Matt

[Francesco Molino]

This means that you're hitting that bug. Have you tried to upgrade to a new version of ISE where the issue has been solved?

[Matthew Martin]

Ok gotcha...

No, we haven't tried upgrading. The issue is more of a small annoyance then a real problem. So we'll probably just wait until we "need" to upgrade ISE.

Thanks for the help, much appreciated!

-Matt