01-20-2025 04:25 PM - edited 01-20-2025 04:26 PM
Recently we recently applied patch 7 to ISE 3.2 to mitigate the issue noted in Field Notice FN74227
Since then I'm receiving alerts about the kibana service not running. As far as I'm aware it was disabled before applying the patch, same as on another ISE instance I'm yet to patch. Show application status of the unpatched (patch 4) ISE instance:
ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
ISE MNT LogAnalytics Elasticsearch disabled
ISE Logstash Service disabled
ISE Kibana Service disabled
show application status of the patched ISE:
ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
ISE MNT LogAnalytics Elasticsearch running 306097
ISE Logstash Service running 309335
ISE Kibana Service not running
How do I disable these services again?
Solved! Go to Solution.
01-22-2025 01:50 PM
I ended up getting TAC involved to fix this. The problem was a duplicate entry in the hosts file for the host itself (!!).
After the engineer got in via a root shell and removed the duplicate line from /etc/hosts the service was able to start and the alert emails have stopped.
01-20-2025 09:29 PM
01-21-2025 02:39 PM
That was showing as already disabled. Nevertheless, I toggled it on/off, however after clicking save the UI sat there for a long time before returning a http-get error.
I also tried a stop/start of the ISE application on the secondary node but it still tried to start the ELK stack:
Starting ISE MNT LogAnalytics Elasticsearch Service...
Starting ISE Logstash Service...
Starting ISE Kibana Service...
ise-kibana-container failed to start ...
01-22-2025 01:50 PM
I ended up getting TAC involved to fix this. The problem was a duplicate entry in the hosts file for the host itself (!!).
After the engineer got in via a root shell and removed the duplicate line from /etc/hosts the service was able to start and the alert emails have stopped.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide