Cisco ISE kibana alert after applying 3.2 patch 7

[b__k]

Recently we recently applied patch 7 to ISE 3.2 to mitigate the issue noted in Field Notice FN74227

Since then I'm receiving alerts about the kibana service not running.  As far as I'm aware it was disabled before applying the patch, same as on another ISE instance I'm yet to patch.  Show application status of the unpatched (patch 4) ISE instance:

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
ISE MNT LogAnalytics Elasticsearch     disabled                     
ISE Logstash Service                   disabled                     
ISE Kibana Service                     disabled  

show application status of the patched ISE:

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
ISE MNT LogAnalytics Elasticsearch     running          306097      
ISE Logstash Service                   running          309335      
ISE Kibana Service                     not running                

How do I disable these services again?

[Greg Gibbs]

Disable the Log Analytics feature - https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/admin_guide/b_ise_admin_3_2/b_ISE_admin_33_maintain_monitor.html?bookSearch=true#Cisco_Concept.dita_6903790d-f80e-49e0-9ee8-ce2a1b9c5f74

[b__k]

That was showing as already disabled.  Nevertheless, I toggled it on/off, however after clicking save the UI sat there for a long time before returning a http-get error.

I also tried a stop/start of the ISE application on the secondary node but it still tried to start the ELK stack:

Starting ISE MNT LogAnalytics Elasticsearch Service...
Starting ISE Logstash Service...
Starting ISE Kibana Service...
 ise-kibana-container failed to start ...

[b__k · Accepted solution]

I ended up getting TAC involved to fix this.  The problem was a duplicate entry in the hosts file for the host itself (!!).

After the engineer got in via a root shell and removed the duplicate line from /etc/hosts the service was able to start and the alert emails have stopped.