Cisco ISE log

[henokk601]

Hi All,

I have one question regarding ISE log. I want to know the changes that have been made on the ISE configuration and which menu should I go to check the logs?

[M02@rt37 · Accepted solution]

Hello @henokk601 

By default, the Audit log retains data for 90 days, but this can be changed in the ISE system settings. Only users with the appropriate permissions can view the Audit log.

On your ISE web Interface click on the "Administration" tab at the top of the page. 

Click on "System" in the left-hand menu, then select "Audit Log" from the drop-down menu.

On the Audit Log page, you can select various filters to narrow down the search for configuration changes, such as date range, user, and operation type.

Once you have selected the filters, click the "Search" button to display the log entries. The log entries will display the time and date of the configuration change, the user who made the change, the operation type (create, modify, delete), the object that was changed, and the before and after values of the object.

[Greg Gibbs · Accepted solution]

With current ISE versions, the information you are looking for should be in the Change Configuration Audit report. See the ISE 3.1 Admin Guide (or check the Admin Guide for your particular version) for more information on the ISE Reports.