Cisco ISE - Potential Discrepancy in logging Categories

[i-camisa]

We've seen a potential issue with the Administrative & Operational Audit logging categories, where a specific use case is not logged under the existing categories. Under the current codes we have: 51000 - Authentication Failure, 51001 - Authentication Success, etc

However there does not seem to be a code & ISE does not create a log (locally or via syslog) when a domain user, with a correct username/password but not the right level of group permissions to access to the web GUI attempts to log in. The same user, with an incorrect password, correctly logs the attempt under code 51000.

We're running Cisco ISE 3.3, with patch 2 installed. Any ideas welcome and is this fixable, or is this a platform limitation?

[Arne Bier]

Very interesting - looks like a bug or something they forgot to add. I can reproduce the same issue in ISE 3.4 p1.

My rsyslog server is receiving logs from ISE for passed auths etc.

ISE tells you that the username/password is invalid. But no logs at all. I would raise a TAC case on this